diff --git a/accounts/usbwallet/ledger.go b/accounts/usbwallet/ledger.go
index 52595a1621..80e63f1864 100644
--- a/accounts/usbwallet/ledger.go
+++ b/accounts/usbwallet/ledger.go
@@ -184,7 +184,7 @@ func (w *ledgerDriver) SignTypedMessage(path accounts.DerivationPath, domainHash
 		return nil, accounts.ErrWalletClosed
 	}
 	// Ensure the wallet is capable of signing the given transaction
-	if w.version[0] < 1 && w.version[1] < 5 {
+	if w.version[0] < 1 || (w.version[0] == 1 && w.version[1] < 5) {
 		//lint:ignore ST1005 brand name displayed on the console
 		return nil, fmt.Errorf("Ledger version >= 1.5.0 required for EIP-712 signing (found version v%d.%d.%d)", w.version[0], w.version[1], w.version[2])
 	}
diff --git a/core/state/statedb.go b/core/state/statedb.go
index b770698255..364bc40850 100644
--- a/core/state/statedb.go
+++ b/core/state/statedb.go
@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"maps"
 	"slices"
+	"sort"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -264,6 +265,9 @@ func (s *StateDB) Logs() []*types.Log {
 	for _, lgs := range s.logs {
 		logs = append(logs, lgs...)
 	}
+	sort.Slice(logs, func(i, j int) bool {
+		return logs[i].Index < logs[j].Index
+	})
 	return logs
 }
 
diff --git a/core/vm/contracts.go b/core/vm/contracts.go
index cae0be9f2d..00ddbebd6b 100644
--- a/core/vm/contracts.go
+++ b/core/vm/contracts.go
@@ -591,7 +591,6 @@ func (c *bigModExp) RequiredGas(input []byte) uint64 {
 		if expLen > 32 {
 			expHead.SetBytes(getData(input, baseLen, 32))
 		} else {
-			// TODO: Check that if expLen < baseLen, then getData will return an empty slice
 			expHead.SetBytes(getData(input, baseLen, expLen))
 		}
 	}
diff --git a/triedb/pathdb/history_trienode.go b/triedb/pathdb/history_trienode.go
index 3f45b41117..1004106af9 100644
--- a/triedb/pathdb/history_trienode.go
+++ b/triedb/pathdb/history_trienode.go
@@ -19,9 +19,11 @@ package pathdb
 import (
 	"bytes"
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"iter"
 	"maps"
+	"math"
 	"slices"
 	"sort"
 	"time"
@@ -386,12 +388,26 @@ func decodeSingle(keySection []byte, onValue func([]byte, int, int) error) ([]st
 		}
 		// Resolve the entry from key section
 		nShared, nn := binary.Uvarint(keySection[keyOff:]) // key length shared (varint)
+		if nn <= 0 {
+			return nil, fmt.Errorf("corrupted varint encoding for nShared at offset %d", keyOff)
+		}
 		keyOff += nn
 		nUnshared, nn := binary.Uvarint(keySection[keyOff:]) // key length not shared (varint)
+		if nn <= 0 {
+			return nil, fmt.Errorf("corrupted varint encoding for nUnshared at offset %d", keyOff)
+		}
 		keyOff += nn
 		nValue, nn := binary.Uvarint(keySection[keyOff:]) // value length (varint)
+		if nn <= 0 {
+			return nil, fmt.Errorf("corrupted varint encoding for nValue at offset %d", keyOff)
+		}
 		keyOff += nn
 
+		// Validate that the values can fit in an int to prevent overflow on 32-bit systems
+		if nShared > uint64(math.MaxUint32) || nUnshared > uint64(math.MaxUint32) || nValue > uint64(math.MaxUint32) {
+			return nil, errors.New("key size too large")
+		}
+
 		// Resolve unshared key
 		if keyOff+int(nUnshared) > len(keySection) {
 			return nil, fmt.Errorf("key length too long, unshared key length: %d, off: %d, section size: %d", nUnshared, keyOff, len(keySection))
diff --git a/triedb/pathdb/history_trienode_test.go b/triedb/pathdb/history_trienode_test.go
index d6b80f61f5..be4740a904 100644
--- a/triedb/pathdb/history_trienode_test.go
+++ b/triedb/pathdb/history_trienode_test.go
@@ -694,7 +694,10 @@ func TestDecodeSingleCorruptedData(t *testing.T) {
 	// Test with corrupted varint in key section
 	corrupted := make([]byte, len(keySection))
 	copy(corrupted, keySection)
-	corrupted[5] = 0xFF // Corrupt varint
+	// Fill first 10 bytes with 0xFF to create a varint overflow (>64 bits)
+	for i := range 10 {
+		corrupted[i] = 0xFF
+	}
 	_, err = decodeSingle(corrupted, nil)
 	if err == nil {
 		t.Fatal("Expected error for corrupted varint")