Flare Node Update: What Operators Must Check by Nov 11
Quick answer. go-flare v1.15.1 must run before Helicon activates November 11: Coston 07:00, Songbird 08:00, Flare 14:00 UTC. Flare says it patches an upstream vulnerability and was brought forward after an active exploit attempt; it names no CVE or losses.
Video transcript
Flare's node software, go-flare version 1.15.1, must run before the Helicon upgrade activates on November 11. Installing it is not enough.
Flare shipped the final release on November 10. Coston activates at seven AM UTC, Songbird at eight, and Flare at two PM. We have not confirmed that any of these activations completed.
Two changes can stop a node from starting: a numeric api-max-duration instead of a duration string, and a lost chain data directory. Also, eth-apis is replaced by apis, some RPC methods are removed, and commit-interval must keep its default.
Flare's announcement channel says the patch fixes an upstream vulnerability, brought forward after monitoring flagged an active exploit attempt. Flare says user funds and keys are unaffected.
These are issuer claims we could not verify. No CVE or mechanism is named, no losses are disclosed, and Flare does not say whether the attempt succeeded.
Guardian analysis: a ready node has the changes applied, starts cleanly and stays synchronized after activation. Indexers, bots and scripts calling removed methods can still fail.
Before each deadline, inventory every node, upgrade and restart, and fix the config. Search dependent code for removed calls. After activation, verify block height and RPC responses.
Read the full article for every check. Guardian's Managed Security matches disclosures against the systems you run, and an engineer helps your team apply the patch.
What Flare Released
Flare Foundation published go-flare v1.15.1 on November 10, 2026, at 18:49 UTC. It is the final, mainnet-capable release of its node software. Flare Foundation, Flare Foundation
The release moves the Flare and Songbird codebase to AvalancheGo v1.15.1, which the release calls the Helicon upgrade. Flare Foundation
The release also warns that a node's C-chain config.json may need changes to stay valid after activation. Flare Foundation
From Testnet to Mainnet
On October 29, Flare shipped a release candidate, v1.15.1-rc.1, for the Coston2 test network only. Flare Foundation
Activation times for Coston, Songbird and Flare were left to the final release. Flare Foundation
What changed on November 10 is reach: a supported build for Songbird and Flare, with fixed activation times. Flare Foundation, Flare Foundation
The Coston, Songbird and Flare activations were upcoming as of 00:20 UTC on November 11. We have not confirmed that any of them completed. Flare Foundation
| Network | Activation (UTC) | Status |
|---|---|---|
| Coston2 | Nov 3, 12:00 | Active, per the final release |
| Coston | Nov 11, 07:00 | Scheduled |
| Songbird | Nov 11, 08:00 | Scheduled |
| Flare | Nov 11, 14:00 | Scheduled |
Config Changes That Can Stop a Node
Per Flare's migration notes, two changes can stop a node from starting. Others remove RPC methods or change defaults and build requirements. Flare Foundation
- api-max-duration must be a duration string such as "30s". After activation, a numeric value stops the node from starting. Flare Foundation
- The string form also works before activation, so this fix can ship now. Flare Foundation
- C-chain execution results now live in the chain data directory, which must persist alongside the database. Flare Foundation
- A node that loses that directory cannot start and must resynchronize. The Docker default path is /app/db/chainData. Flare Foundation
- eth-apis is deprecated in favor of apis. Flare Foundation
- The admin, warp and personal namespaces are removed, with eth_accounts, eth_coinbase, eth_etherbase and several debug RPCs. Flare Foundation
- state-sync-enabled now defaults to true. commit-interval must stay at its default of 4096. Flare Foundation
- Staking parameter flags, such as --min-validator-stake, --min-stake-duration and --uptime-requirement, are now ignored on Flare, Songbird, Coston and Coston2. Flare Foundation
- Building from source requires Go 1.26.10 or later. Flare Foundation
What Flare Says, and What Is Unknown
The release and migration notes describe a scheduled upgrade. Flare Foundation, Flare Foundation
Flare's official Telegram announcement channel gives the reason. It says v1.15.1 patches a vulnerability in upstream code used by Flare nodes, and that the fix has been tested. Flare Official Announcements
Per that post, the rollout was planned for later in November. Flare says it brought the rollout forward after monitoring flagged an active exploit attempt. Flare Official Announcements
Flare does not say whether the attempt succeeded. Flare Official Announcements
Flare also says user funds and keys are unaffected, ordinary users need take no action, and normal operation continues once validators upgrade. Flare Official Announcements
The post also says engineering and validators are coordinating the rollout, and it urges node operators to upgrade. Flare Official Announcements
The Telegram post shows no verified publication date. Its linked Flare Devs announcement on X could not be opened. Flare Official Announcements
On November 11, the public GitHub advisory pages for go-flare and AvalancheGo listed no published advisories. Flare Foundation, Ava Labs
The release, migration notes and GitHub advisory pages name no CVE, mechanism, affected versions or losses. Flare's statements are issuer claims we could not check independently. Flare Foundation, Flare Foundation, Flare Foundation, Ava Labs
Installing the Binary Is Not Enough
Guardian analysis: installing v1.15.1 is not readiness. A node is ready when the changes above are applied, it starts cleanly and it stays synchronized after activation.
Dependent services are exposed too. Indexers, wallets, bots and monitoring scripts that call removed methods can fail after the switch, even when the node itself runs. Flare Foundation
Flare's announcement names only the Flare hard fork at 14:00 UTC; Coston and Songbird activate earlier, at 07:00 and 08:00. Flare Official Announcements, Flare Foundation
Checks for Node Operators
Run these before each network's activation time, then again after it.
- Inventory every Coston, Songbird and Flare node and RPC endpoint, with owner, network and running version.
- Upgrade each node to v1.15.1, commit 98082dc, then restart it before activation and confirm it starts cleanly. Flare Foundation
- Set api-max-duration as a duration string. Flare Foundation
- Put the chain data directory on persistent storage, and back it up with the database. Flare Foundation
- Replace eth-apis with apis. Flare Foundation
- Keep commit-interval at its default. Flare Foundation
- Search clients, indexers and scripts for calls to removed namespaces and methods. Flare Foundation
- After activation, compare block height with the network, and confirm RPC responses are correct.
- Keep a fallback RPC route, such as a second synced node, in case one fails.
- Watch Flare's official channels for any security disclosure that follows the release.
Upstream Code, Downstream Risk
Flare's node builds on AvalancheGo. When shared code needs a fix, each downstream network has to ship it and each operator has to adopt it. Flare Foundation
Our Cosmos EVM explainer traces that pattern: one shared bug, exploited on six chains after a public fix.
In a Synthetix LP vault review, finding L-48 flagged keeper infrastructure on an outdated AWS CDK version with known vulnerabilities and a deprecated AWS SDK (Low, resolved). Guardian
It is an analogy, not Flare's flaw. Dependency upkeep has to cover the infrastructure around contracts, not just the contracts.
Frequently Asked Questions
Can the Coston2 release candidate run on Flare or Songbird?
No. v1.15.1-rc.1 refuses to start on those networks, with an error saying mainnet is not supported. Songbird and Flare operators need the final v1.15.1 release. Flare Foundation, Flare Foundation
Does Helicon add anything for smart contracts?
Yes. The migration notes describe a new read-only P-chain gateway precompile at 0x0300000000000000000000000000000000000000. It lets C-chain contracts read P-chain data during execution. Flare Foundation
Where are the full migration requirements published?
In RELEASES-flare.md on the go-flare repository's main branch. That file can change after publication, so recheck it before each upgrade rather than relying on an earlier copy. Flare Foundation
Related reading
Sources
- Flare Foundation: Release v1.15.1
- Flare Foundation: Release Notes: Flare and Songbird networks
- Flare Foundation: Release v1.15.1-rc.1 coston2
- CoinNess: CoinNess live feed: Flare deploys vulnerability patch, hard fork set for Nov. 11
- Guardian: Synthetix Auto-Compounding LP Vault: finding L-48
- Guardian: Managed Digital Asset Security Services
- Flare Official Announcements: Flare Official Announcements: go-flare v1.15.1 rollout, post 429
- Flare Foundation: go-flare Security Advisories
- Ava Labs: AvalancheGo Security Advisories
Match every advisory to the nodes you run
Guardian's Managed Security matches disclosures against the systems you run. A Guardian engineer confirms the exposure and works with your team to apply the patch.