Changelog

​

New

• One v1 CashIn shape with cashIn.updated (breaking): create, GET, list and every cashIn.* webhook now return the version 1 cash-in body, and refreshing a cash-in’s barcode announces cashIn.updated so partners don’t have to poll for a new code. The npm package jumps to 107.0.0 and drops the fields the v1 shape no longer carries.
• Virtual-account fiat payout flow sends the same webhooks on every rail (breaking): a dollars-in dollars-out virtual account payment (flow 10.11) now sends the same sequence of transaction and transfer events across ACH, wire, international wire and fiat-wallet book transfer, proved row by row by a parity suite. An ACH return of a payout now invalidates the external account that received it (matching the behavior already in place for deposit addresses and fiat-wallet withdrawals), so the next deposit is held under awaitingAction.payoutDestinationMissing until the partner sets a new destination. Money a bank returned can now leave the service: ops can refund it to the sender, or re-send it re-pinned to an account other than the one that returned it. The npm package jumps to 106.0.0, and the msg string on error 10240 changes.
• Card buy and card sell flow sends the same webhooks (flow 10.12): a card buy’s charge is a deposit transfer on rail card that settles when the processor reports the charge final; a card sell’s push is a payout transfer on rail card; a card sell never reads a cashPickup sub-status; and a card decline reports a dedicated failure.code (new sentinel values seeded for the specific processor rejection codes) instead of the generic providerError.
• payoutOrigin, wire instruction id and full cash location back on partner reads: payoutOrigin returns on the transaction, deposit address and virtual account (in GET and in every v1 webhook); an incoming wire’s instruction id now sits in the transfer’s tracking next to imad, uetr and endToEndId; and a cash-in’s location carries locationProvider and a structured locationAddress object instead of a single line of text.
• Admin deposit address carries payoutOrigin: operator reads of a deposit address (admin GET, admin list, force-close and deactivate) now return payoutOrigin {type, id, accountHolder, accountHolderName}, so the operations dashboard can keep showing whose name a payout goes out under even though the v1 partner shape no longer carries it.
• Provider sweep for unconfirmed fiat payouts: every fiat payout now carries a reference the provider can be queried against (custom_ref, the leg’s public transaction id), and a background sweeper asks the provider about every payout that reads processing.payoutUnconfirmed. If the provider is holding the transfer, the payout continues as that transfer and settles, fails or is returned as the provider reports; nothing is sent twice. If the provider has none, the payout fails with failure.code: providerTimeout and the transaction follows its flow’s failed-payout row (processing.underReview on deposit address and virtual account payouts, failed.outboundFailed on a fiat wallet withdrawal). The ops redrive, refund and mark-failed endpoints call the same lookup first, so none of them can re-send or refund a payout the provider may still be holding. A new error 10369 unconfirmedPayoutUnverifiable surfaces when the provider cannot be reached; the npm package bumps to 107.1.0.

​

Fixed

• Per-transaction limits apply to the fiat leg of a crypto-pinned withdrawal: a source-pinned crypto-to-fiat sell (for example ETH to USD on ach) is now subject to its project’s per-transaction maximum, minimum and multiple, evaluated against the corridor’s fiat leg. Daily and monthly caps were already enforced; the per-transaction check previously fell open because the pinned crypto quantity was treated as having nothing meaningful to compare against.
• Transfer tracking keeps the on-chain hash when vendor metadata cannot be decoded: a transfer whose vendor metadata failed to decode previously dropped its entire tracking object, including the on-chain txHash, even though the readable references were meant to be preserved. The hash is now a column of its own, so a partner read keeps it (and every other reference the service could read) while the decode failure still logs.

​

Updated

• L2 syncer BlockFinality default is FinalizedBlock (breaking): [BridgeL2Sync] and [L2GERSync] now default to BlockFinality = "FinalizedBlock" instead of "LatestBlock", so each syncer stops indexing L2 blocks that may still be reorged. [ClaimL2Sync] inherits the new value through its existing {{BridgeL2Sync.BlockFinality}} reference. Deployments that want the old behavior (for example a CDK Besu RPC whose finalized tag does not advance) can still set BlockFinality = "LatestBlock" explicitly in their configuration.

​

Fixed

• Bridge tracker never reports claimed for an unclaimed bridge mid-persist: during a tracker tick that moves a bridge across several steps, a concurrent GET /tracker/v1/activity/from/{addr}?includeTracking=true could read the latest step as pending while an earlier step already read done, so tracking.claim_status fell back to the final Claimed step as claimed even though the bridge had not been claimed on chain. The activity refresh persisted and served that stale claimed from cache for up to 30 s, hiding the Claim button in UIs that drive their state from it. Snapshot reads now ignore an in-flight persist, so an unclaimed bridge never reads claimed.

​

New

• transaction.statusChanged is written by the leg write (breaking): every leg write now decides and writes transaction.statusChanged in its own database transaction, from the payment’s reading before and after the write, so about twenty per-site emitters are gone and no partner-visible transition can disappear. One meaning per sub-status: processing.fundsPulled means only that the customer’s own money was taken; a payout that failed while OMS holds the money reads processing.underReview; an ops retry reads processing.payoutRetrying; a payout OMS stopped waiting on reads processing.payoutUnconfirmed; a refund in flight reads processing.returningToSender; a refund that reached the sender ends failed.returnedToSender; a single-leg provider refusal reads failed.providerDeclined. TransactionSubStatus drops failed.returnPending, failed.returnStarted, failed.returnComplete, failed.returnFailed and awaitingAction.depositAddressInactive, and adds processing.payoutRetrying, processing.payoutUnconfirmed, processing.returningToSender, failed.returnedToSender and awaitingAction.payoutDestinationMissing. A transaction with a refund in flight or a stranded payout no longer matches status=failed. The npm package jumps to 102.0.0.
• One transaction.hold shape (breaking): transaction.hold is {code, message, deadline?, match?} and present only while the transaction is awaitingAction. code is senderAttribution or payoutDestinationMissing, message is a fixed sentence that names no provider, and deadline and match {address, network} appear on senderAttribution only. The deadline follows the bpn/needs_attribution_timeout_hours setting instead of a hardcoded 30-day constant; the union of hold arms, required, since, resolvedAt and matchableExternalAccountCriteria leave the schema.
• One externalAccount shape and three events (breaking): GET, list, create and update return the v1 external account, and externalAccount.created, externalAccount.statusChanged and externalAccount.updated carry exactly the same body. The account is an instrument: details match what a transaction shows for it, customer is always named, owner {kind, id, name} appears only when a counterparty owns it, bank accounts carry details.holderName, cards carry details.last4 and details.brand, and wallets list destinations by {asset, network}. Per-type objects, category, owner.customerId/owner.counterpartyId and the create response’s resolvedTransactions are removed; supportedDestinations moves to one top-level list. API creates now announce externalAccount.created as pending before the statusChanged to active, and any writer that changes details, failure, label or metadata sends externalAccount.updated naming the changed fields in changedFields. A declined card now carries failure.code: cardVerificationDeclined instead of the generic providerError. The npm package jumps to 103.0.0.
• One depositAddress shape with created and updated events (breaking): the deposit address renders through one v1 snapshot across GET, list, create, update and every depositAddress.* webhook. A bank destination’s rail and ACH options move from the destination into payout {rail, secCode?, companyDiscretionaryData?}; returnDestination is an instrument {type, id, asset, network, owner, details}; destination.payoutOrigin, expectedSourceAsset/expectedSourceNetwork, sourceToDestination and depositInstructions.expiresAt are removed; hold, sponsorGas and requiresCounterpartyWalletRegistration appear only when set, and returnDestinationTypes only when not empty. Every create now announces depositAddress.created as pending in the create transaction (a provider that issues the address during the create call then follows with statusChanged to active in the same transaction), and a PATCH that leaves the status alone sends depositAddress.updated naming the changed fields. The npm package jumps to 104.0.0.
• One virtualAccount shape with created, updated and a deleting status (breaking): the virtual account carries one v1 snapshot across GET, list, create, update and every virtualAccount.* webhook. source, sourceToDestination, payoutOrigin and finalBalance are removed; a bank or fiat-wallet destination’s rail and ACH options move into payout {rail, secCode?, companyDiscretionaryData?}; returnDestination is the bank account instrument with its rail on returnPayout.rail; BIC is lowercased to bic, supportedSources[] names its rail (internationalWire where it read international_wire), empty bank fields are omitted, and sponsorGas appears only when true. Every create announces virtualAccount.created as pending, a PATCH that changes the label, metadata, destination, return destination or re-reported bank details sends one virtualAccount.updated naming the changed fields in changedFields, and a delete now moves the account through a new deleting status: statusChanged from the live status to deleting, then deleting → deleted once the close completes. A provider that cannot close right now restores the prior status; a provider refusal ends failed. The npm package jumps to 105.0.0.
• POST /admin/transactions/{transactionId}/complete-refund: an operations-only endpoint that completes a virtual account bank refund whose provider only reported it initiated and never a completion. Body carries a required reason; the refund (pending, in flight or failed) moves to completed, its review flag is cleared, the operator and reason are recorded, and the transaction ends failed.returnedToSender with the refund transfer settled. A repeat call answers already_completed; other payments return 422 refundNotCompletable (code 10368). The stuck-transaction alert gains an open_refund arm so ops see refunds still open past the threshold.
• Pre-stamp provider-send sweepers (ship dark): two new background sweepers find deposit-address payout sends and direct bank-sell sends whose transaction row stopped BEFORE the pre-call provider_ref stamp (so no provider call was ever made) and fail them, so the partner no longer sees processing forever. Both ship dark behind per-sweeper configuration flags (default false, read every tick) and run on a single pod. The provider_ref stamp now refuses to write onto a failed row (errProviderRefStampRefused), stopping a stalled send that stamps after its row was already failed from issuing a vendor call for a leg the partner was told failed.

​

Updated

• Transaction body is the v1 shape (breaking): tracking, sourceToDestination, estimatedArrival, expiresAt and projectId leave GET and the events; each transfer carries its own txHash, imad, uetr and endToEndId. precursor is left out when a transaction has no recognised origin instead of serialized as null. metadata carries only the partner’s own keys: the server no longer injects memo, charge_bearer or crypto_from_address (those values already live under source.details.memo and the source instrument’s address). The admin body keeps tracking, sourceToDestination and projectId.
• Deposit address flows crypto in, fiat out and crypto in, crypto out send the same v1 webhooks on both supported providers: every step is announced in order, every rail (ACH, wire, RTP, international wire) and both own-asset and converting payouts included. A payout transfer now reads initiated until the provider reports it in flight (previously pending from acceptance on one provider), a payout the provider reports only once final now carries the earlier steps too (steps 4 and 5 announce together, in order), ops’ resend after an on-chain send failure is a new attempt on a fresh key, and a deposit whose destination external account was deleted reads awaitingAction.payoutDestinationMissing with hold.code: payoutDestinationMissing on both providers and resumes on its own once the partner sets a new destination. A deposit address paying out on Polygon now reads processing.awaitingCryptoOut while it waits.
• Virtual account flow fiat in, crypto out sends the same v1 webhooks on both supported providers: steps 1 to 5 and failures A to E on both providers and both deposit rails (wire and ACH); a settled deposit now reads processing.awaitingCryptoOut on both providers until the custodial buy completes; a refund is announced as a transfer (initiated, then pending in flight, then settled on completion), with partial or zero amounts respected; a payout wallet that was deleted holds the deposit under awaitingAction.payoutDestinationMissing and resumes once the partner sets a new destination; a virtual account routing to a registered external wallet with no stored address pays out with the account’s address instead of an empty to; and the deposit’s from carries the sender’s bank account (bank name, routing number, holder name on ACH, last-4 on IBAN) as far as the rail reports it, with holder name stored encrypted and masked in kept event bodies.
• Withdrawal flow sends the same v1 webhooks on every path: the four paths that serve a withdrawal (bank sell, same-pair send, converting send and fiat-wallet payout) now announce the same sequence of events, in the same order, with the same statuses. A withdrawal row reads its own payout rather than a stored sub-status, so GET, the list and every event agree. A withdrawal row OMS stopped waiting on reads processing.payoutUnconfirmed with its payout transfer pending; a converting withdrawal whose swap converted and whose send then failed reads processing.payoutRetrying until the recovered send completes, not failed. An ops Mark failed can now close a withdrawal’s own stuck row (ends failed.outboundFailed with its payout failed), refused with 422 vendorOrderExists when a COMPLETED SEND webhook is already stored for the row.

​

Fixed

• Virtual account status webhooks are announced: a provider’s activation, lock, unlock or label refresh now announces virtualAccount.statusChanged in the transaction that writes the status, instead of staying silent until a sweeper or an admin refresh happened to find it.
• A stuck virtual account delete completes: a delete the provider could not answer with a close webhook is now reconciled on every sweep. The sweeper reads the account against the provider’s deposit account API and finalizes deleting → deleted as soon as the provider reports it closed, re-sending the close on the stored idempotency key behind the balance and open-transaction gates. A provider that answers the close with HTTP 429 now reads as close-unavailable (the delete answers 503 with Retry-After and the account keeps its status) instead of surfacing as a generic 502.
• A provider-reported virtual account refund is a transfer: REFUND_INITIATED writes the refund leg pending keeping the returned figure, REFUND_IN_FLIGHT moves it to pending, and REFUND_FAILED holds the money for review with returnFailed. The held span flushes the transaction’s statusChanged first and the transfer events after, so the partner never sees the deposit failed on its own.
• A refunded deposit whose buy was superseded reads its refund: GET and the status filter agree with each other, so a refunded deposit whose buy had been superseded no longer reads failed.inboundFailed while its refund is in flight.
• A deposit reported failed and then completed is one transaction: a provider pair that reports a deposit FAILED on a false-positive compliance screen and then COMPLETED is now one transaction (the completed arrival takes over the failed row’s id, payment and webhook history); only the hashless and not-active-address cases stay two transactions by design, and a late FAILED for an already-credited deposit is refused as a claim duplicate.
• Deposit address and virtual account country codes come from the referenced external account: a deposit address created through the API no longer renders an empty country on the SWIFT payout or the CSV export; both now read country_code from the account the destination references, scoped to the deposit address’s own project.
• DepositAddress and VirtualAccount renders share one SEC-code and party resolver: an ACH payout’s secCode is derived from the resolved party’s entity type; counterparty entity types batch into one ResolveParties read per page, and a failed lookup leaves secCode out without failing the render.
• A deposit address deactivation keeps the destination and return destination: the admin deactivate endpoint now closes the deposit address and releases its wallet without clearing its destination or return destination, matching force-close behavior. An ops return on a deactivated address can therefore choose returnDestination.
• Attribution timeout follows its setting: the attribution sweeper now reads bpn/needs_attribution_timeout_hours at every sweep and carries it to the SELECT and the timeout event, so a changed timeout moves the moment a deposit fails together with the hold.deadline the partner sees. An unreadable, unparseable or missing setting keeps the last value read instead of silently falling back to a shorter default.
• A withdrawal is never failed early: a payout that could still complete reads processing.payoutUnconfirmed, not failed, and a converting withdrawal whose send failed after the swap converted reads processing.payoutRetrying while the recovery mints the next attempt. The create call for such a withdrawal now answers 201 with the in-flight reading instead of 502.

​

New

• Bridge service fee estimation endpoints: two new read-only endpoints on the bridge service, GET /bridge/v1/claim-fee-estimate (takes destination network, origin network and token) and GET /bridge/v1/bridge-fee-estimate (takes origin network and token). Both fail closed: 503 when no estimate is computable, 400 on invalid input, never a default or partial value. Estimators are wired per network at startup and exposed through the proxy via network_id; no TOML configuration changes.
• config_render CLI: a new tool under tools/config_render that composes and resolves an aggkit configuration file through the same pipeline the aggkit binary uses. Each default layer can be overridden (--default-values, --default-vars, --mandatory-vars), --cfg is repeatable (merged in order), output goes to stdout or -o <file>, env overrides use --env-prefix (default CDK), and --deprecated-fields <file> or --use-default-deprecated-fields runs a deprecated-fields check. The tool fails with exit code 1 listing every unresolved variable or any cycle.

​

New

• One pricing shape on quotes, transactions and cash-ins (breaking): every amount is now a decimal string at its asset’s precision ("500298.310000" for USDT, "10.00" for USD), and pricing is one shape with {source, destination, fees, exchangeRate?, fixedAmountSide?, sponsorGas?}. pricing.{source,destination}.amountGross/amountNet collapse to pricing.{source,destination}.amount (source net and destination gross follow from pricing.fees), pricing.sponsorGasCost is removed, pricing.sponsorGas is omitted unless true, and pricing.exchangeRate appears only together with a destination amount. pricing.*.asset and pricing.fees[].asset are lowercase and PricingSide.asset is always present. CashIn gains pricing and loses rates, sponsorGas, sponsorGasCost, developerFees and the amounts on source and destination. The npm package jumps to 97.0.0.
• One instrument shape on sources and destinations (breaking): Transaction, Quote, DepositAddress and VirtualAccount render each source and destination through one builder: {type, id?, asset, network?, owner?, details?}. party becomes owner (absent for the resource’s customer’s own account), category is removed, displayName and the top-level memo move into typed details, details.blockchainAddress becomes details.address, a bankIban sender’s accountNumberLast4 becomes ibanLast4, unknown ids and rails are left out instead of rendered as null, and asset and crypto network values are lowercase. TransactionSide gains two arms (depositAddress, virtualAccount). The npm package jumps to 96.0.0.

​

Updated

• GET /networks hides the vendor query parameter from the public schema: the public schema no longer documents the vendor query parameter on GET /networks or the PaymentProviderVendor enum. The parameter still exists at runtime and continues to validate (a bad value still returns 400 InvalidParameter 10006); it is marked x-internal and kept in the internal schema the OMS dashboard reads. The public schema version is v26.10.14-0001; the npm package bumps to 92.0.8.

​

Fixed

• Published paymentMemo pattern accepts every ACH-allowed character: the published schema’s paymentMemo scalar matches the union of the ISO 20022 and NACHA addenda sets, so generated validators such as zPaymentMemo stop rejecting memos such as INV_42# that the server already accepts on ach and achSameDay. The per-rail server rule is unchanged and still returns 422 on an off-rail character.
• Validation error 10030 carries a generic message (breaking): ValidationErrorResponse.msg on error 10030 is "request validation failed" instead of the memo-specific "destination.details.memo must use NACHA-allowed characters only:" sentence that was reaching the wire on every call site. The specific reason stays in cause. Prefer branching on the stable error or numeric code and reading cause. The npm package bumps to 95.0.0.
• Erebor deposit webhook amounts no longer 10,000x too small: the deposit_address.crypto_deposit.* and needs-attribution webhooks previously divided Erebor’s cents amounts by 10^6, so a $500,298.31 USDT deposit rendered as "50.029831". The dedicated Erebor formatter now converts cents through the same path the transaction row uses and formats at the asset’s precision.
• Coinme crypto payout carries an amount while in flight: a same-pair Coinme crypto payout leg previously left pricing.destination and the old deposit_address.crypto_payout.* webhooks with no amount until the terminal SEND webhook. The amount Coinme accepts to send is now stamped at submission (for same-pair and VA forward sends), and the terminal webhook still overwrites both with the realized amount.
• Deposit address create resolves one vendor on a two-vendor corridor: POST /deposit-addresses previously ran two independently-timed catalog loads (the create’s own vendor resolution and the bank-rail classification gate), which could observe different routes.priority states on a corridor two vendors serve and bind the create to one vendor while the gate judged the other. The catalog is now loaded once per request and the snapshot is shared.

​

Updated

• Immutable zkEVM networks removed: IMMUTABLE_ZKEVM (13371) and IMMUTABLE_ZKEVM_TESTNET (13473) are dropped from supportedNetworkChainIds, and the yield-proxy chain id and network name allowlists lose 13371 and immutablezkevm. The vendored chain data map still carries Immutable’s USDC entry (the same convention used when zkEVM networks were previously removed), and the legal terms page is unchanged.

​

New

• Producer stall and slow-announce metrics: worker/build_to_announce/over2s and /over4s count exact threshold crossings independent of the scrape interval, worker/producer/stalled is a gauge that names the block number this node is stuck on as the span producer (0 otherwise), and worker/producer/stalls counts stall episodes shorter than a scrape. The existing worker/build_to_announce timer now starts when the producer was first allowed to build (the later of commitWork and the parent slot boundary), so prepare work is included but the deliberate Giugliano boundary wait is not; dashboards built on it will see slightly higher values.

​

Fixed

• Sequencer seal gate confirmed on our own seal through a reconcile: a contested seal gate is now confirmed as soon as a reconcile sees the acked journal include that seal, using the same hash-keyed check retire() uses. On a tail match behind ackedSeq the frontier is no longer pulled back; it is held in place and only rewound after laggingReadBound (8s, two recoverGrace intervals) when the store genuinely lost acked entries. New counters sequencer/reconcile/laggingread and sequencer/reconcile/storebehind cover the two cases. Four Amoy blocks over the last 30 days show the pre-fix four-second seal-to-broadcast delay; with the fix the gate settles on the reconcile.

​

New

• POST /admin/transactions/{transactionId}/fail-interrupted-send: an operations-only endpoint that fails an interrupted cash-provider payout leg the provider cannot answer for (same-pair crypto legs, or a leg whose project cannot be bound), after operations has checked the provider’s dashboard. Body carries a short reason and acknowledgeDoubleSendRisk: true; the leg is marked failed with vendor_order_created=unknown and a token-authored attestation, and the partner receives the usual payout-failure event. Ineligible requests return 422 InterruptedSendNotEligible (code 10365) with nothing written; a repeat answers already_failed.

​

Fixed

• GET /networks reports supportedBy.wallet on custodial-wallet pair networks: a project whose custodial wallets live on a network outside the always-served set now sees wallet on that network’s entry, derived from the same custodial-wallet pair gate the project is already subject to and narrowed by ?vendor=. Networks with no custody configuration still omit wallet; fiat and cash entries never carry it. The npm client bumps a patch to 92.0.7; no type, field, or enum changes.
• Interrupted cash-provider DA payout sends resolved against the provider instead of hanging pending: a new background sweeper picks up DA payout legs stuck at pending with provider_ref stamped but no outcome recorded. For a bank leg it asks the cash provider for the order and either adopts it at processing when the provider has it live, marks it failed with vendor_order_created=unknown and emits the partner’s *_payout.failed and transaction.statusChanged events when the provider confirms no order (after a 30-minute lookback) or reports it failed, or leaves it pending for the next tick. For same-pair crypto legs, which the provider’s order read does not index, the sweeper only acts on an explicit failed answer; use the admin endpoint above when operations has confirmed the state. The sweeper never re-sends.
• Interrupted direct bank-sell creates handed to the existing reconcile: a sibling sweeper takes direct (non-DA) bank-sell rows stuck in the create-time processing state with provider_ref stamped but no execute outcome, stamps a submitInterrupted reason, and lets the existing bank-sell reconcile adopt the row when the provider has the order live or hold it for operations when the provider reports it failed. The reconcile now holds a provider-reported failure (status_reason=orderFailedByVendor) for operations rather than adopting it as submitted.

​

Fixed

• Passkey wallets with pending updates get fee options back: sending from a passkey wallet with pending configuration updates on the target chain no longer fails fee-option quoting with a relayer 400 InvalidPasskeySignature. The wallet SDK is bumped (wallet-core 3.0.14, wallet-wdk / relayer / dapp-client 3.1.2, wallet-primitives / guard 3.0.13) so the pending update is simulated with a stubbed passkey signature and the on-chain checker’s chained digest validates. Google and email wallets (ECDSA signers) were never affected. A regression test pins the stubbed-signature behavior against the embedded SDK.

​

Fixed

• Inbound static peers protected from the dropper: the p2p dropper now checks static-set membership on every peer, not just the outbound static-dial flag, so a peer listed in static-nodes that happens to dial the local node first stays connected under inbound-slot pressure instead of being evicted and reconnecting. Nodes listed in both static-nodes and trusted-nodes were already protected via Trusted(); static-only entries now get the same guarantee.

​

New

• payoutOrigin.id on bank deposit addresses names the customer’s active Virtual Account across every supported provider: a bank-destination deposit address whose customer holds an active Virtual Account from the same provider now records that Virtual Account’s id on DepositAddressPayoutOrigin.id across every provider that issues Virtual Accounts, matching behavior that previously only applied on one provider. payoutOrigin.accountHolder stays customer, and a missing Virtual Account finder now fails the deposit-address create instead of recording an incomplete snapshot.

​

Updated

• Raw walletExternal address accepted on crypto-to-crypto quotes for supported routes: POST /quotes with a crypto source and a walletExternal destination now accepts destination.details.blockchainAddress on the project’s supported routes, matching the behavior that already worked when the same destination was supplied as destination.details.id naming a registered external account. Unsupported routes continue to return 422 CryptoToCryptoExternalAddressUnsupported.
• GET /networks hides restricted USD bank rails from external-account destinations: a USD bank rail excluded by the project’s own outbound rail restrictions no longer appears under supportedBy.externalAccount.asDestination, so a dashboard that builds its withdraw rail list from this field stops offering rails every quote and transaction gate rejects with 422 bankRailNotSupported. The response shape is unchanged. ach and achSameDay share one ach catalog entry, so a project that permits only one of them still sees ach advertised.

​

Fixed

• GET /wallets reflects balances immediately after a wallet-to-wallet quote conversion: when a quote converts funds between two of a customer’s own custodial wallets, the create call refreshes the customer’s custodial balances as soon as the transaction row is durable, so the project-wide wallet list (GET /wallets with no customerId) renders the new source and destination balances without waiting on a provider webhook, a per-customer GET /transactions/{id} poll, or the 15-minute swap-strand sweeper.

​

New

• Card onramps land on the destination chain when the provider supports it: for a USDC destination, both card onramp paths now request their quote and widget session on the destination chain’s native USDC and land there directly, with a two-step pending diagram. A chain or token the configured provider cannot deliver falls back to USDC on Base and bridges, with the three-step diagram and the real intermediary chain and token named instead of being hardcoded.
• onramp.cardProviders widget prop: a per-widget allowlist for the Credit or debit card row. Omitted, empty, or all-unknown lists keep today’s behavior (every available provider). Excluding a provider skips its client-config request, so it costs no call and its pending state cannot hold the card row in loading.
• RequestAggLayerClaim on the Trails API: an integrator that bridges through the AggLayer unified bridge themselves can hand Trails (originChainId, originTxHash, depositCount?, destinationAddress?) and Trails records a synthetic CLAIM_ONLY intent and runs the destination claim on the integrator’s behalf. Gated by [agglayer] claim_service_enabled, with configurable access-key, project, and destination-chain allowlists; a repeat request for the same leaf returns the existing intent, and an already-claimed leaf creates nothing.
• Host-branded embedded wallets in the wagmi adapter: an existing wagmi connection now takes walletName and icon from the host wallets descriptor before the catalog, so an app-branded embedded wallet shows the app’s name and logo in the connect list, the connected chip, and the funding selector. The adapter README documents the full recipe.
• Labelled amounts and provider logos in the card onramp selector: each provider row shows an “Estimated amount” caption above the destination-token amount with its USD value underneath, and renders the provider’s theme-matched logo (or a lettered placeholder on absence or failure) beside its name.

​

Updated

• v1 intent execution removed from the Trails API (breaking): QuoteIntent, CommitIntent, and ExecuteIntent reject v1 with ErrIntentProtocolDeprecated; CreateProtocolHandler refuses v1. Stored v1 intents stay readable and recoverable through GetIntent, receipts, and GetIntentHistory?byIntentProtocol=v1. The default protocol is now v1.5, and a configuration or project mapping of "v1" warns and uses v1.5 instead.
• Card provider screen titled “Pay by card”: fits on one line at modal width next to the back button, the card-brand marks, and the close button. The fund screen row that leads here keeps its “Credit or debit card” label.
• Card onramp quote rejections name the limit: a provider’s below-minimum or above-maximum response renders as a specific message (for example “The minimum amount is 10.00 USD”) instead of the generic “An API error occurred” fallback. The server-side error now carries a which is <amount> <currency> fragment the widget parses, and the amount-limit branch runs ahead of the generic API-error branch so the concrete message is not swallowed.
• Card onramp providers advertised only when the deployment holds their key: GetStripeClientConfig.enabled combines the feature flag with a secret key for the requested environment, and GetOnrampProviderAvailability counts a provider as enabled only when its client is configured. A deployment without keys hides the provider instead of failing after the user commits.
• Non-selected card onramp provider amounts reflect the Trails fee model: a helper recovers the fee buffer from the selected quote, treats gas and the Trails fee as flat costs, and multiplies each other provider’s remainder by the quote’s effective rate, so provider rows read as like-for-like post-fee amounts rather than the selected row’s post-swap value against the others’ pre-swap payouts.
• GetIntentHistory.balances[].tokens always an array: an intent address with no indexed tokens now serializes as "tokens":[] instead of null, matching the generated clients’ required-array contract. Older SDKs that call balance.tokens.map(...) on the history screen no longer crash.
• Keyless Trails API quoting fails loudly on the SDK: trailsApiKey is optional throughout the SDK, and quoteIntent throws “Trails API key is not configured” before any request when the resolved client has neither an access key nor a JWT, so integrators without a key no longer see the API’s opaque AccessKeyNotFound 401.

​

Fixed

• Receipt polling continues after a failed wallet send: if a wallet send fails for any reason other than a user rejection, the widget hands off to intent-receipt polling for ten minutes instead of showing the deposit-not-confirmed error while still saying “Waiting for wallet”. A late deposit the backend sees now flips the widget off the waiting screen through onOriginSend. User rejections still fail immediately.
• Card onramp popup no longer falsely reported as closed: when a provider checkout navigates to a cross-origin page that severs the opener handle, the widget skips the window.closed interval for that provider and relies on the provider’s transaction-status polling, matching the standalone integration.
• Exchange onramp list honors the resolved API URL and provider-configured key: the demo exchange-toggle section falls back to the environment Trails API URL when its override is empty, and the SDK’s “From exchange” screen resolves its API key from the widget prop, the onramp provider config, and the Trails provider (in that order), so an integrator who configures the key once on TrailsProvider sees integrations instead of a “No supported exchanges” message.

​

Fixed

• destination.pickupCode on cash pickup transactions: GET /transactions/{transactionId} now renders destination.pickupCode whenever the cash provider has issued the code. The code is written on the execute response, on the GET-time status poll (the provider can issue the code asynchronously, after the order is already confirmed), and on the ops reconcile; a code-only change is persisted without emitting a partner event. Rows previously confirmed without a stored code pick it up on the next GET or the next status poll.

​

New

• Sequence store publisher and follower (opt-in): block producers publish each block’s lifecycle (open context, per-transaction records, sealed header) to the sequence store as it happens; RPC nodes follow the stream, re-execute it deterministically, and hold preconfirmation receipts for the block being built. The role is derived from the sealer flag (a mining node publishes, a non-mining node consumes) and everything is gated behind a new [sequencer] configuration section. With the section unset there is no behavior change.

​

Updated

• Autoclaim removed (breaking): the autoclaim/ package, the /autoclaim/v1/* REST endpoints, and GET /bridge/v1/claim-candidates are all removed. The [AutoClaim] configuration section is gone, autoclaim is dropped from every --components= list and from the AUTOCLAIM component registry, and the dedicated autoclaim docs are removed. docs/bridgetracker.md is now self-contained, and the e2e claim helpers now route through aggkit-proxy.

​

New

• GET /wallets list rows now carry type and details: each row is the same custodial or fiat variant that GET /wallets/{id} returns for that wallet, with details.asset, details.network, and details.address for custodial rows and details.asset: "usd" for fiat rows. No extra per-row read is required to learn a wallet’s asset or network, and balances, routing, and customer are unchanged. The npm client bumps to 90.0.0: WalletListItem and zWalletListItem are replaced by WalletResource and zWalletResource on the list response. The server must be deployed before any consumer bumps to @polygonlabs/bpn-rest-api 90.
• Card buys accept a registered walletExternal id as the destination: POST /quotes with a card source and a walletExternal destination now accepts destination.details.id naming a saved external wallet on supported routes, matching the behavior that already worked when the same destination was supplied as destination.details.blockchainAddress. On unsupported routes 422 WalletExternalIDUnsupported still fires.
• Base USDC and USDT available as virtual account destinations: POST /virtual-accounts accepts USDC and USDT on Base as a destination for USD routes, and GET /networks surfaces Base under supportedBy.virtualAccount.asDestination for USDC and USDT on projects whose configured routes include them.

​

Updated

• Counterparty address optional on supported projects: POST /counterparties makes address optional on projects whose configuration does not require one; every other project still requires an address, and a supplied address is still validated in full. A counterparty with no stored address now omits address from the response entirely instead of rendering a zero-value {}; this response change applies to all projects. The OpenAPI marks Counterparty.address and CounterpartyCreateRequestCommon.address optional and the generated TypeScript client bumps to the next major.

​

New

• walletExternal.custodian is now optional: on POST /external-accounts with type: walletExternal, custodian is optional on the request and omitted from the response when not stored. It is still required when the project’s resolved provisioning configuration requires it. When required and missing, the response is 422 with the new CustodianRequired error (code 10360). The npm client bumps to 88.0.0 to carry the response-field optionality.

​

Updated

• Owner-field requirements follow the project’s resolved provisioning configuration: POST /external-accounts and GET /reference/account-type-requirements both derive owner-field requirements from the same resolved provisioning configuration, so the two paths cannot disagree. A project whose owner-requirements table has no entry for its resolved provider is now rejected with 422 AccountTypeRequirementsNotMet instead of silently admitted; the missing-field list is also sorted deterministically.

​

Fixed

• walletExternal.details.blockchainAddress surfaces on registered destinations: GET /transactions/{transactionId} now renders walletExternal.details.blockchainAddress whenever the destination address is known, independent of whether the destination external account is registered. Previously a destination that resolved to a registered external account rendered details: null, requiring a second GET /external-accounts/{id} call to retrieve the address.

​

New

• Configured proving endpoints: a node can route proving requests through its configured endpoints.
• Configurable L1 and L2 RPC clients in aggkit-proxy: the proxy accepts separate L1 and L2 RPC client configuration and uses HashFromJSON for consistent hash decoding.
• Configurable gRPC decoding ceiling: MaxDecodingMessageSize is now configurable per gRPC client.
• Autoclaim identifies API requests by global index: autoclaim surfaces each API request’s global index for correlation across callers.

​

Updated

• V5 signature commitment required for legacy ECDSA certificates (breaking): the RPC accepts only the V5 signature commitment for legacy ECDSA certificates; prior commitment formats are rejected.
• GER finalization no longer gates settlement: settlement proceeds without waiting on the GER finalization requirements that previously held it.
• Glamsterdam block-hash support: the go-ethereum dependency is bumped to v1.17.7 so block hashes compute correctly on Glamsterdam.
• toBlock inconsistency logs downgraded: the toBlock inconsistency message is downgraded below ERROR to reduce noise under normal RPC skew.

​

Updated

• Yield proxy allowlist tightened: both filters (the wallet-side Earn allowlist and the yield proxy) now treat a known chain ID as final; the fuzzy name match applies only to networks reported without an ID. Monad (143) and Somnia (5031) are added to the proxy’s ID allowlist.

​

Fixed

• Removed chains that are no longer served: Polygon zkEVM (1101), Blast (81457), Blast Sepolia (168587773), Xai (660279), Xai Sepolia (37714555429), B3 Sepolia (1993), Monad Testnet (10143), Incentiv (24101), Incentiv Testnet v2 (28802), Sandbox Testnet (6252), TOY Testnet (21000000), and SKALE Nebula Testnet (37084624) are removed from the wallet’s supported-chains list. The yield proxy also drops moonbeam, homeverse, and oasyshomeverse from its name-based allowlist so those networks can no longer slip through.

​

Updated

• POST /external-accounts type narrowed to the create-time arms: the OpenAPI ExternalAccountCreateType enum on POST /external-accounts is now bankUs, bankIban, bankCanada, or walletExternal. Server behavior is unchanged: card registration continues to go through the dedicated card endpoint, and type: "card" on the generic create still returns 422 CardMustUseCardEndpoint. Reads, lists, and AccountTypeRequirement continue to use ExternalAccountType, with card kept as a valid value for existing card external accounts. TypeScript clients regenerated from the schema can no longer pass card to the generic POST /external-accounts request.
• Error-code casing in operation descriptions: public operation descriptions now cite error codes in the casing they are emitted with on the wire. Codes served through the shared registry render as PascalCase (for example WalletNotActive, WalletTypeNotSupported); direct-emit codes such as externalAccountAlreadyRegistered and bridgeTimeout keep their camelCase. Field names, enum values, and the literal-string codes themselves are unchanged.

​

Fixed

• Same-pair crypto send settles to a final sub-status: a transaction whose outbound leg is a crypto send stays in processing with subStatus: processing.awaitingCryptoOut until the send confirms, then settles with subStatus: completed.settled on success or subStatus: failed.outboundFailed on failure. GET /transactions/{transactionId} no longer finalizes the transaction while it is awaiting the outbound send. A send that fails after submission now carries failed.outboundFailed on both the stored row and the transaction.statusChanged event, in place of the earlier processing.awaitingCryptoOut leak.

​

New

• 503 ServiceUnavailable on POST /counterparties: counterparty create can now return the shared ServiceUnavailableErrorResponse (error: ServiceUnavailable, code: 5003) when a downstream dependency is unavailable. The response shape matches the 503 already used on POST /deposit-addresses, POST /external-accounts, POST /quotes, POST /virtual-accounts, and the other create and read operations. Treat it as retryable; existing retry policies for those endpoints extend to counterparty create unchanged.

​

New

• Sequence-store preconfirmation pipeline (opt-in): a block producer can serve pre-import preconfirmations against the sequence store with new RPCs eth_sendRawTransactionForPreconf, bor_getPreconfTransactionReceipt, and bor_getInvalidPreconfBlocks, with store audit, read-breaker gating on a frozen tail, and preserved preconf receipts across canonical import (#2373, #2388, #2393, #2423, #2427, #2439).
• WIT2 BP-signed witness announcements: Bor announces BP-signed witnesses with transitive relay and pre-import serving, a size oracle for non-deterministic witnesses within a signed size band, and a gas-derived page-count ceiling (#2208, #2416, #2417).
• Pipelined state-root computation on block import (opt-in) (#2180).

​

Updated

• consensus/bor/heimdall honors the configured request timeout (#2411).
• eth_sendRawTransactionSync releases the execution slot while it waits (#2385).

​

Fixed

• BlockSTM V2 parallel balance across self-destruct boundary resolves correctly (#2403).
• Trace log counting: logs counted without being copied when tracing (#2460).
• Txpool signer under allow-unprotected-txs: the pool signer is no longer swapped when allow-unprotected-txs is set (#2464).
• Static peers dialed across jails and dynamic slots (#2438).
• Dangling tx-fetch peers retried instead of excluded forever (#2367).

​

New

• Bridgetracker SQLite-backed cache: tracker and activity state cached in SQLite (#1852), with background-refreshed /activity (#1856), on-chain-anchored start_date/end_date (#1864), parallelized scans with configurable bridge-service timeout (#1844), RPC-based fallback for recent bridges (#1838), claim-status reporting (pending/readyToClaim/claimed/error) (#1831), and pagination on the activity endpoint (#1888).
• Public bridgeservice config endpoint: GET /bridge/v1/config is public (#1828); sync status for all syncers exposes is_halted (#1877).
• aggkit-proxy CORS and proxy metrics: REST and WebSocket endpoints accept CORS (#1807); proxy cache size and alive counts are exposed as Prometheus metrics (#1871).
• Minimal certificate identifiers on network-info (#1740, #1758).

​

Updated

• Per-destination autoclaim cursors with bridge-service health sync and bridgetracker emitter verification (#1854); EthTxManager defaults and start-block defaulting cleaned up (#1875); L1 finality knobs made independent (#1849); error URLs redacted and bridgeservicefinder auto-registration gated (#1862).
• bridgeservicefinder skips dead networks via a new IgnoreNetworkIDs filter (#1810).
• Settlement retries gateway and request timeouts (#1741, #1746).

​

Fixed

• Autoclaim L2-to-LX block cursor: a permanently disabled source no longer pins the cursor (#1882).
• Exact settlement tx resolution for WaitL1SettledGER (#1866).
• BridgeResponse.GlobalIndex encoded as BigIntString, not a bare JSON number (#1835).
• l2gersync adapted to the RPC eth_getLogs block-range cap (#1813).
• Reverted settlement jobs: superseded on certificate resend (#1800); the admin API can unlink a certificate from its reverted job (#1795); out-of-range certificate heights saturated instead of failing in metrics (#1805).

​

New

• Robinhood Chain (4663) support: live across Trails SDK (#1245) and the Trails API (#1151).
• Arc (5042) support: live across Trails SDK (#1242) and the Trails API (#1146), with USDC price alias to Ethereum USDC (#1148) and CCTP support (#1124).
• Card-onramp provider chooser by country: the widget routes the card onramp to the available provider per country, with a chooser only when more than one is available (#1274); a session-scoped geo cache gates fund methods by onramp availability (#1219, #1110, #1111).
• Pay-with-crypto settlement via the widget stripe prop: the widget accepts a stripe prop and settles USD from any token (#1241, #1106); the storefront demo pays with it (#1239); settlement quotes can choose the deposit chain (#1125).
• defaultDisplayCurrency widget prop (#1277).
• disablePassthrough widget prop forces the intent flow (#1248, #1153).
• consentCheckbox widget prop: optional consent gate above the confirm button (#1222).
• labels widget prop: overrides widget copy (#1217).
• intentId on widget lifecycle callback payloads (#1247).
• OMS publishable API keys accepted by the OMS API gateway, backward-compatible with existing access keys (#1160).
• Earn transaction hashes exposed by the SDK (#1234); the backend accepts yield transaction hash submission (#1123).

​

Updated

• Flat wallet list with per-wallet Select Chain picker and EVM-scoped connect CTA (#1228); embedded-wallet connectors hidden unless the host features them (#1270); wallets connect in any order with just-in-time EVM owner (#1225).
• Chain picker skipped for single-chain wallets (#1236); widget chain filter ordered by the shared chain order (#1254); origin ChainList filter applied in Pay mode (#1243).
• Rebasing tokens rejected at quote time with 7004 RebasingToken (#1164).

​

Fixed

• Tron deposits: the SDK refuses to sign an RPC transaction that doesn’t match the request (#1264).
• Widget theming: widget screens honor theme CSS variables, including the WalletConnect QR container (#1262, #1271, #1272).
• WalletConnect runtime fallback: Trails falls back to its own WalletConnect runtime when host adapters have no pairing connector (#1269).
• Funding method screen shows the history and settings header buttons (#1275).
• Reconciliation: missing REFUND rows created on reconciliation (#1156); reconciled meta-txns verified by emitter with fallback refunds recorded (#1114).

​

Removed

• An exchange onramp provider retired (#1246, #1152).

​

New

• Shielded token balances in the wallet inventory: OMS Wallet reports shielded token balances alongside the standard inventory (#371).

​

Updated

• Yield proxy worker performance and reliability (#372).

​

Fixed

• Mobile Settings menu, Earn deposit/withdraw, Earn amount parsing/labels/vault state, and Earn accessibility (WCAG 2.2 AA), plus removal of dead chains (Moonbeam, Moonbase Alpha, Homeverse, Homeverse testnet) (#372).
• Private Send progress flow aligned to the current step model (#370).
• Expired-session authentication loops recovered automatically (#367).
• Unavailable networks removed from the UI: chains no longer served by OMS Wallet infra are dropped (#378).

​

New

• GET /customers/{customerId}/risk-id: reads the existing opaque risk identifier without enrolling the customer or creating a session. Returns null when the customer is not enrolled. Accepts a normal bearer token, or a publishable Api-Key paired with a customer-bound bearer token from /customers/{customerId}/token. Browser requests require a non-empty merchant Origin validated against the publishable key’s origin policy.
• GET /risk/config: returns the browser-side provider identifiers (clientId, partnerId) for the OMS risk SDK. Authenticates with a publishable key and returns only provider identifiers; no customer identity. Missing provisioning returns 503 RiskConfigUnavailable.
• Customer.totalBalance on single-customer reads: GET /customers/{customerId} now returns a totalBalance object with totalUsd, fiatUsd, and cryptoUsd (two decimals, sign preserved). Covers fiat wallets and custodial crypto wallets; non-custodial wallets are not yet valued. Omitted when the rollup cannot be read, so treat an absent field as “unknown” rather than zero. The list, create, and update endpoints do not carry it.
• rtp added to the US bank network vocabulary: rtp is now selectable on quotes and Deposit Address destinations where the receiving bank participates, and on POST /virtual-accounts/{virtualAccountId}/simulate/inbound-transfer. It is not supported as a Virtual Account destination rail.
• Tron support for registered external wallets: networkFamily: "tron" is accepted on POST /external-accounts with type: walletExternal where the project’s provider serves it. The blockchainAddress must be a mainnet Base58Check address (leading T, case-sensitive); the zero account is rejected.
• walletDeposit precursor type: a transaction created from a recognized custodial-wallet deposit now renders precursor: { type: walletDeposit, id: null } instead of precursor: null. Filter on precursorType=walletDeposit to match those rows. precursor: null is now reserved for genuine out-of-band arrivals with no recognized origin at all.
• awaitingAction.informationRequested sub-status and HoldInformationRequested: a transaction can now pause for a compliance or source-of-funds follow-up. hold.type is informationRequested, with instructions (human-readable, free text) and requestedFrom (today either customer or developer). There is no API endpoint to satisfy the request; the hold clears when the information arrives through the normal operational channel.
• DepositAddress.returnDestinationTypes: deposit address responses carry a read-only array listing the walletCrypto and walletExternal return targets the address accepts, derived from the issuing provider and expectedSourceNetwork. An empty array means no return destination can be configured. The field is on API responses only; it is not included in the depositAddress.statusChanged event payload.
• /cash-locations validates radius and limit: the search radius must be greater than 0 and at most 100 miles; the page limit must be between 1 and 100 inclusive. Typed clients regenerated from the schema pick up the bounds as minimum/maximum constraints.

​

Changed

• Card routing moves from the transaction create to the quote: POST /transactions is now just quoteId, webSessionId, deviceFingerprint, and metadata. settlementType, externalAccountId, paymentMethodId, externalCustodyCreditInfo, sourceWalletAddress, and tags have been removed from the transaction-create request. The card and source wallet are taken from the referenced quote. A card buy delivers to the quote’s destination address when destination.type is walletExternal, and otherwise to the customer’s custody wallet on the destination chain; a card buy without a reachable on-chain delivery wallet is rejected with 422 ExternalDeliveryWalletRequired. The related error schemas (InvalidSettlementType, ExternalAccountIDInvalid, ExternalAccountRailMismatch, ExternalAccountRequired, ExternalCustodyNotAllowed, ExternalSellUnsupported, SourceWalletAddressNotAllowed) and the ExternalCustodyCreditInfo object are removed.
• Virtual Account bank routing exposes supportedSources per block: each routing entry under instructions.bankUs now lists the sender networks it accepts in supportedSources, limited to the incoming rails the partner has enabled. A single entry can accept both US domestic and international deposits; fields that apply to none of the networks in that entry’s supportedSources are null.
• US external account uniqueness tightened for custodial bank accounts: when the project’s bank accounts are registered with a custodial provider, a routing-and-account-number combination is held once per customer across the customer and all its counterparties. Re-registering one the provider already holds returns 409 externalAccountAlreadyRegistered with details.matchedOn: routingNumberAccountNumberCustomer and details.existingAccountId naming the registered account.
• Richer 422 descriptions on client-side rejections: Virtual Account / Deposit Address / External Account create responses carry explicit descriptions of what makes a client error terminal; /cash-ins/{cashInId}/refresh names the two refresh-limit cases (refreshLimitReached and refreshTooFrequent) and when Retry-After is populated. These are documentation-only improvements; the error codes and shapes are unchanged.

​

Removed

• Transaction-create card routing fields: see “Card routing moves from the transaction create to the quote” above.
• Error schemas tied to the previous card-create path: InvalidSettlementTypeErrorResponse (10144), ExternalSellUnsupportedErrorResponse (10160), ExternalAccountIDInvalidErrorResponse (10257), ExternalAccountRailMismatchErrorResponse (10263), ExternalAccountRequiredErrorResponse (10264), ExternalCustodyNotAllowedErrorResponse (10265), and SourceWalletAddressNotAllowedErrorResponse (10266) are no longer emitted and are removed from the schema. The ExternalCustodyCreditInfo object is removed with them.

​

New

• Customer.riskId: customer responses now include a read-only riskId, an opaque identifier used by the OMS browser risk SDK. It is populated once risk enrollment for the customer is complete; customers without an enrollment do not carry the field.
• ExternalAccount.invalidReasonCode: an external account in status: invalid now carries the provider’s own code for the failure alongside invalidReason. For US bank payouts this is the NACHA return code, for example R15. Use invalidReason to decide what to do; use invalidReasonCode when you need the exact provider code for support or reconciliation.
• GET /external-accounts status filter: the list endpoint accepts a new status query parameter to filter to a single lifecycle status. Omitting status continues to exclude soft-deleted rows; pass status=deleted to list them.

​

Updated

• ExternalAccountInvalidReason enum extended: the closed set gains accountHolderDeceased and accountDoesNotSupportTransfers for bank rails, and billingAddressMismatch, cardExpired, cardClosedOrLostStolen, pushToCardUnsupported, and cardDeclinedByIssuer for card rails. Existing values keep their meaning; regenerated typed clients pick up the new members automatically.
• GET /external-accounts filters are all optional: customerId, counterpartyId, and the new status filter are all optional. Omitting them lists every non-deleted external account in the project (still tenant-scoped).

​

Updated

• Base path bumped to /v0.13: sandbox is now https://sandbox-api.polygon.technology/v0.13 and production is https://api.polygon.technology/v0.13. The old /v0.12 base path is no longer served. Update client configuration and any hard-coded URLs. Regenerated typed clients pick up the new base path automatically; hand-written HTTP clients must be updated. No request or response shapes change with this cutover; every schema, field, and error code carries forward as-is.
• GET /transactions walletId filter accepts fiat wallets: the walletId query parameter on GET /transactions now filters transactions where a crypto wallet (wlt_ prefix, legacy acc_ also accepted) or a fiat wallet (wlt_fiat_ prefix) is the source or destination instrument. Callers that already send a wlt_ value see no change.

​

New

• Tron network in the crypto network vocabulary: network: "tron" is now a valid value on crypto request fields, and blockchainAsset.protocol adds tvm. Availability of a given (asset, network) pair on Tron is enforced at runtime per destination type; call GET /networks for the live catalog. NetworkFamily on a registered external wallet accepts tron alongside evm and solana. usdc and usdt are the supported assets on Tron.
• bankUs responses carry per-account supportedDestinations: GET /external-accounts and GET /external-accounts/{externalAccountId} return a supportedDestinations array on every bankUs account. Each entry is an (asset, network) pair with the rails that specific account can be paid over (ach, achSameDay, wire, and, where the underlying bank participates, rtp), plus a minimumAmount and maximumAmount when the source-of-truth limits are known. The list never advertises a rail that a subsequent create-time gate would refuse; an absent rtp entry can mean either the specific bank does not participate or participation could not be verified.

​

New

• Counterparty-owned bankUs external accounts supported end to end: POST /external-accounts with owner.kind: "counterparty" and type: "bankUs" provisions a payout destination, and a subsequent POST /quotes referencing the returned ext_ ID as destination is accepted rather than rejected with 422 accountTypeRequirementsNotMet. The payout settles on ACH with the counterparty as recipient. A legacy counterparty that predates the structured name split (no stored entityType) is still rejected on this rail; register the counterparty with the required entityType and name fields before quoting.
• Counterparty identity used as the paying-bank beneficiary: on a counterparty-owned US bank payout, the beneficiary registered with the paying bank uses the counterparty’s own firstName and lastName (or businessName) and address from the counterparty record. The customer’s identity is not used for a counterparty-owned destination.

​

Changed

• POST /counterparties requires entityType and split name fields: the counterparty create request now takes an entityType discriminator of individual or business and the matching name fields (firstName and lastName for individual, with optional dateOfBirth; businessName for business). A missing entityType returns 422 with code: entityTypeRequired, an unrecognized value returns 422 with code: entityTypeInvalid, and a flat name field is rejected with 400. Each arm rejects unknown keys (422 validationError). Responses echo the split fields and add a read-only name composed as businessName or firstName + " " + lastName.
• PATCH /counterparties/{counterpartyId} immutable name and entityType: both entityType and the composed name field are rejected with 400. Name updates go through the split fields for the stored entityType; a name field that does not belong to the stored entityType returns 422 validationError. The server recomposes name on every accepted update.

​

New

• bankUs external accounts default accountType to checking: when bankUs.accountType is omitted on POST /external-accounts, the account is created with accountType: "checking". An explicitly supplied checking or savings value continues to win.
• bankUs responses always carry accountType: GET /external-accounts, GET /external-accounts/{externalAccountId}, and PATCH /external-accounts/{externalAccountId} always populate accountType on a bankUs response object. Generated clients that previously typed the field as optional see it as required after regenerating from the schema.

​

New

• ExternalAccountInvalidReason closed enum on invalid external accounts: an external account that transitions to status: "invalid" now carries invalidReason from the closed set accountClosed, accountFrozenByBank, routingOrAccountNumberInvalid, payeeNameMismatch, walletUnreachableOnNetwork. invalidReason was previously typed as a free-text string; typed clients regenerated from the schema now see it as a closed enum. invalidFields accompanies each transition and lists the fields that must change for a replacement external account to be accepted.
• Automatic invalid from ACH returns: seven NACHA return codes (R02, R03, R04, R13, R15, R20, R23) on a US bank ACH payout now transition the destination external account from active to invalid and emit externalAccount.statusChanged. Any active virtual account or deposit address that references the invalidated external account is fanned out to inactiveActionRequired and emits its own statusChanged. Other ACH return codes remain a no-op; wire and SWIFT rails are out of scope for this transition. A deposit address that was re-pointed between the payout send and the return is left as is rather than invalidating the new destination. An account that lands in invalid requires registering a new external account and re-pointing dependents; every reachable invalidReason describes a permanent identifier condition with no automatic recovery.

​

New

• Austin hardfork activated on mainnet with Bor v2.10.0: Austin rolled out on mainnet on August 13, 2026 alongside Bor v2.10.0. Node operators must be on v2.10.0 or later.
• Ithaca hardfork activated on Amoy and mainnet: Ithaca activated on Amoy at block 40,776,000 (July 20, 2026, ~14:00 UTC) and on mainnet at block 50,185,000 (July 29, 2026, ~14:00 UTC) through Heimdall v0.10.0. Ithaca closes the post-Rio liveness hole by autonomously rotating a span when the >1/3-agreed Bor head stops advancing past a stall threshold, so a stalled block producer no longer halts Bor production while a pending milestone tally sits in the 1/3–2/3 band.
• BlockSTM v2 and devp2p peer jailing default-on in Bor v2.9.1: Bor v2.9.1 enables BlockSTM v2 parallel transaction execution and devp2p peer jailing by default. Peer jailing replaces blanket drops on transient sync failures with a graded response that jails misbehaving peers before permanent drops, keeping healthy peers on the network under load.
• Valencia hardfork release: Bor v2.9.0 is the Valencia hardfork execution client. RPC providers who have not yet moved to v3.7.1-priv should upgrade Erigon to at least v3.6.1 before running against a post-Valencia network.

​

New

• Solana chain support in 0xtrails 0.17.0: 0xtrails 0.17.0 is live in production with official Solana chain support across the Trails API, SDK, Explorer, and Docs. Prior SDK versions remain compatible with the latest API; no breaking changes were introduced. The Trails Demo and Trails Explorer are updated with Solana intents.

​

New

• OMS Non-Custodial Wallet available under any OMS project: OMS Non-Custodial Wallet is live under every OMS project on the OMS Dashboard, so a project can enable and configure non-custodial wallet support without an operator handoff.
• OMS Wallet Playground: an interactive playground at wallet-playground.polygon.technology exercises every OMS Wallet feature end to end, so an integrator can try wallet flows before wiring a client.
• Production-ready client SDKs: OMS Wallet ships production-ready TypeScript, React Native, iOS, and Android SDKs, so mobile and web clients integrate against the same authenticated wallet surface.
• Non-custodial wallet docs, including Earn and Swap guides: OMS Wallet documentation is finalized at docs.polygon.technology/wallets/non-custodial-wallets, covering setup, Earn, and Swap.

​

Updated

• Base path bumped to /v0.12: sandbox is now https://sandbox-api.polygon.technology/v0.12 and production is https://api.polygon.technology/v0.12. The old /v0.11 base path is no longer served. Update client configuration and any hard-coded URLs. Regenerated typed clients pick up the new base path automatically; hand-written HTTP clients must be updated.

​

Removed

• set-settlement-tx-hash retired on admin_forceEditCertificate: every request that carries a set-settlement-tx-hash operation is rejected with INVALID_PARAMS, whether the operation sets or clears the hash. The rejection happens while parsing the operation, before the certificate header is read, so a certificate with no settlement job is not exempt. There is no replacement: pinning the L1 block that this operation had been repurposed for when reprocessing a Proven certificate is no longer supported. Drop the operation from any operator tooling that called it.

​

Updated

• Transaction.subStatus is now required: every transaction read and every transaction.statusChanged webhook now carries a concrete subStatus. Each top-level status has a default member when no more specific value applies, so the field is never absent and never null. Handlers that guard against a missing subStatus can drop the check; continue to branch on status, and read subStatus for display and logging only. The enum remains open: new members may be added without an API version bump, so unknown values should fall back to the status prefix before the dot (an unrecognized processing.someFutureThing still means processing).
• New subStatus members: processing.initiated (the default for a freshly created transaction), awaitingAction.held (a default hold state), completed.settled (the default terminal-success state), and failed.unspecified, failed.expired, and failed.outboundFailed (default terminal-failure states). The previously documented members (for example processing.fundsPulled, processing.cashPickupReady, completed.cashPickupCollected, and the failed.return* family) are unchanged.
• Optional memo extended to SWIFT destinations: the customer-supplied payment memo now applies to a bankIban destination (SWIFT rail) and to a bankCanada destination on the USD/SWIFT leg, in addition to a bankUs destination with network: "wire". The character set, 140-character maximum, and honored-surface rules are unchanged: memo is honored on a deposit-address destination and rejected with 422 memoNotSupported on any other surface or rail (a bankUs ACH rail, the CAD/local leg of bankCanada, quotes, and virtual accounts). Send null to restore the generated memo.

​

New

• companyDiscretionaryData on ACH bankUs destinations: POST /deposit-addresses and its PATCH re-points accept an optional destination.details.companyDiscretionaryData on a bankUs destination with network: "ach" or network: "achSameDay". OMS carries the value verbatim in the NACHA batch header on every outbound ACH payout. This is the originator’s internal metadata and never reaches the beneficiary; it is distinct from memo, which does. Max 20 characters; uppercase NACHA character set (A-Z, 0-9, space, and & - . $ * / # @ %). Rejected with 422 memoNotSupported on a bankUs destination with network: "wire".

​

Renamed

• walletOms renamed to walletCrypto: the type discriminator for an OMS-custodied crypto wallet is now walletCrypto on every instrument surface (quote source and destination, transaction source and destination, deposit-address and virtual-account destinations, deposit-address returnDestination). The rejection code for using it as a payout destination is now destinationWalletCryptoNotSupported. The related schema names change accordingly (WalletCryptoSideRequest, WalletCryptoInstrument, WalletCryptoDestination, WalletCryptoDetails, WalletCryptoSideDetails). Update any request payloads that send "type": "walletOms" to send "type": "walletCrypto" and switch any error-code handling from destinationWalletOmsNotSupported to destinationWalletCryptoNotSupported. The wallet-ID formats (wlt_ on responses; legacy acc_ still accepted on requests) are unchanged.

​

New

• walletFiat is now a supported destination on virtual accounts and deposit addresses: POST /virtual-accounts, POST /deposit-addresses, and their PATCH re-points accept a walletFiat destination arm that holds the inbound USD as a fiat balance in the customer’s OMS fiat wallet. Credit is delivered by an internal book transfer, so the resolved destination instrument reads network: "bookTransfer" and no external rail is used. The wallet must belong to the route’s customer (422 walletCustomerMismatch), be active (422 walletNotActive), and hold usd; the project must have the book_transfer outgoing rail enabled (403 destinationRailNotAllowed). Auto-created transactions for a virtual account’s walletFiat destination carry sourceToDestination: "fiatAccountToFiatAccount"; deposit address auto-created transactions carry sourceToDestination: "cryptoToFiatAccount". A PATCH that switches a destination between kinds involving walletFiat (for example, from a walletExternal crypto arm to a walletFiat arm, or vice versa) is rejected with 422 destinationTypeSwitchNotSupported.
• displayName on instrument reads: transaction, quote, deposit-address, and virtual-account reads now include a displayName on each side (source, destination, returnDestination) as an opaque, render-only summary suitable for list and detail rendering without a follow-up lookup. Examples include a masked account tail such as ••••1234 for a bank instrument, a shortened blockchain address for a wallet, or a merchant name for a cash pickup. displayName is not contractual: its format may change without a version bump and it never carries a full account number, IBAN, or PAN. Do not parse it.
• Embedded customer summary on transactions, deposit addresses, and virtual accounts: reads now include a customer object with id and name, resolved from the owning customer, so list and detail rendering does not need a follow-up GET /customers/{customerId} call. customer is always the record’s owning customer (Transaction.customerId, VirtualAccount.customerId, DepositAddress.customerId), independent of which side a party sits on.
• ownerDisplayName on external accounts: reads of an external account whose owner.kind is customer now include an ownerDisplayName field carrying the customer’s display name, so external-account lists render an owner label without a follow-up fetch. The field is absent for counterparty-owned accounts (no counterparty name resolver is wired for this resource).

​

Updated

• Virtual account sandbox inbound simulation amount cap: the amount accepted on POST /virtual-accounts/{virtualAccountId}/simulate/inbound-transfer is now capped at 10.00 for both the bankUs and bankIban arms; values above the cap are rejected with 400 amountExceedsCap. This affects sandbox only; production behavior is unchanged.

​

Removed

• rtp removed from bankUs network: the bankUs instrument’s network no longer accepts or renders rtp. The accepted US bank rails are ach, achSameDay, and wire on every surface that carries a bankUs details object (quote source and destination, transaction source and destination, deposit-address and virtual-account destinations, external-account reads). Requests that send "network": "rtp" are rejected as an invalid enum value; typed clients regenerated from the schema drop the member from the union.

​

New

• GET /networks: a new Reference-tagged endpoint returns every network OMS supports, with its identifiers, available assets, and which OMS resources (external accounts, deposit addresses, virtual accounts, cash-ins, and OMS wallets) can use it as a source or destination. Availability is derived from live route configuration, so a network absent from the response is not routable. Fiat-rail availability reflects the calling project’s own configuration; crypto networks are global. Each entry carries category (crypto, fiatAccount, or cash), type (blockchain, bankRail, card, or physical), a displayName, and, for blockchains, chainId and networkFamily.

​

Removed

• POST /deposit-addresses/{depositAddressId}/simulate/inbound-transfer: the deposit-address sandbox inbound-transfer simulation is retired. Continue to simulate deposit-address behavior end to end by observing the auto-created transaction and webhook flow when funds arrive; sandbox simulations for virtual accounts and cash-ins are unchanged.
• Sandbox tag on deposit-address simulation: the OpenAPI Sandbox tag no longer covers deposit addresses. The remaining sandbox simulations (virtual accounts and cash-ins) continue to group under it.

​

Updated

• CryptoNetwork enum on crypto network fields: DepositAddress.expectedSourceNetwork and the deposit-address returnDestination.network are now typed as the shared CryptoNetwork enum (ethereum, polygon, base, solana). The wire values, casing, and rejection codes are unchanged: expectedSourceNetwork still accepts only ethereum, base, or solana and rejects anything else with expectedSourceNetworkUnsupported; the return network must equal the deposit address’s expectedSourceNetwork for the return to be usable. Values remain lowercase on the wire.

​

New

• Optional memo on bank destinations: the shared bankUs destination now carries an optional memo field that OMS delivers to the beneficiary’s bank in the ISO 20022 unstructured remittance-information field. It is honored today only on a deposit-address bankUs destination with network: "wire", where the stored value replaces the memo OMS would otherwise generate for every outbound Fedwire payout from that deposit address. Because the memo is read when each payout wire is built, an edit affects only future payouts, never one already in flight. Max 140 characters; allowed characters are letters, digits, space, and /?:().,'+-. Send null to restore the generated memo. A non-empty memo on any other surface or rail (quote or virtual-account create and update, or a deposit-address bankUs destination on the ach or achSameDay rails) is rejected with 422 memoNotSupported.

​

Updated

• walletOms no longer accepted as a destination: on POST /deposit-addresses, POST /virtual-accounts, and POST /quotes (and the corresponding PATCH re-points), a walletOms destination is rejected with 422 destinationWalletOmsNotSupported. Use walletExternal referencing a registered external wallet (ext_wlt_ ID) to deliver crypto onward. walletOms remains valid on the quote source. Cash-in continues to deliver directly to an OMS wallet through its own destination.wallet.id shape and is unaffected.

​

New

• Base path bumped to /v0.11: sandbox is now https://sandbox-api.polygon.technology/v0.11 and production is https://api.polygon.technology/v0.11. The old /v0.10 base path is no longer served. Update client configuration and any hard-coded URLs.
• Associate an embedded wallet with a customer: POST /customers/{customerId}/wallets/associate links an embedded (WaaS) wallet to an existing customer. The wallet is identified by a WaaS ID token in the request body; the token’s subject is the wallet ID (so the wallet ID is never passed directly) and the token’s audience must be the authenticated project. Returns the associated wallet.
• List transactions per route: GET /deposit-addresses/{depositAddressId}/transactions and GET /virtual-accounts/{virtualAccountId}/transactions return the auto-created transaction history for a specific deposit address or virtual account, with cursor pagination and the standard transactionType, since, and until filters.
• Webhook lifecycle endpoints: POST /webhooks/{webhookId}/enable reactivates a disabled or suspended webhook and resets the failure episode. POST /webhooks/{webhookId}/disable stops dispatch and skips queued deliveries. POST /webhooks/{webhookId}/rotate-key issues a new HMAC signing key and returns it in cleartext once. POST /webhooks/{webhookId}/test sends a synthesized test delivery so partners can verify signature and reachability. WebhookStatus is now an enum of enabled, disabled, and suspended, replacing the previous enabled boolean; suspended is set only by the service when the endpoint is unhealthy.
• Webhook delivery inspection and retry: GET /webhooks/{webhookId}/deliveries returns paginated deliveries filterable by status, eventId, test, and a createdAfter/createdBefore window. GET /webhooks/{webhookId}/deliveries/{deliveryId} expands a single delivery with its HTTP attempts (target URL with credentials stripped, method, headers, body snapshot, response headers and body, timing, and error). POST /webhooks/{webhookId}/deliveries/retry requeues deliveries: pass explicit deliveryIds, or a status plus a createdAt range to retry all matching deliveries. Every retry is audited.
• Webhook create response schema: POST /webhooks returns { webhook, signingKey }, where signingKey is the cleartext HMAC signing key. It is shown once at creation and once per rotation, and never returned again. The whsec_ secret prefix is retired.
• Webhook subscriptions replace events: POST /webhooks and PATCH /webhooks/{webhookId} take a subscriptions array in place of the previous events field. Pass ["*"] to receive every event type, or list specific event names to filter. WebhookRequest also accepts timeoutMs (per-webhook HTTP timeout, default 5000, cap 10000) and notifyThresholdSecs (down-notification threshold, 600 to 86400 seconds, default 3600). Webhook responses add mode (live or sandbox), statusReason, subscriptions, timeoutMs, notifyThresholdSecs, and lifetime successCount and failureCount.
• Webhook list envelope: GET /webhooks now returns WebhooksList with a data array of WebhookListItem entries, each combining the webhook with a deliveryCount, successCount, failureCount, a failureRate in basis points (0 to 10000), and a lastDelivery summary. Pagination moves to opaque cursor and limit (default 20, max 100), replacing startingAfter/endingBefore. Filter by status.

​

Updated

• GET /wallets/{id}/transactions replaces GET /accounts/{id}/transactions: the wallet transaction ledger moves under the wallet path. The id path parameter accepts a wallet ID with the wlt_ prefix, and the response shape and filters are unchanged.
• Webhook path parameter renamed: GET, PATCH, and DELETE on a single webhook now use {webhookId} in the path in place of the previous {id}. DELETE /webhooks/{webhookId} is now a soft delete: the webhook is hidden from list and get, but delivery history is retained for the configured retention window.

​

Removed

• GET /accounts/{id}/transactions: retired. Use GET /wallets/{id}/transactions instead. The endpoint had been marked deprecated in favor of the wallet-scoped ledger.
• enabled boolean on Webhook: replaced by the WebhookStatus enum (enabled, disabled, suspended). Toggle state with POST /webhooks/{webhookId}/enable and POST /webhooks/{webhookId}/disable rather than a PATCH on enabled.
• whsec_ signing secret prefix and the secret field on Webhook: the signing material is now returned as signingKey on the create and rotate-key responses only. Webhook never carries a signing field on read.

​

New

• Per-resource sandbox simulations for cash-ins: cash-in simulation is now scoped to a specific cashInId, in three lifecycle steps. POST /cash-ins/{cashInId}/simulate/present-code simulates the customer presenting the deposit code at the register, POST /cash-ins/{cashInId}/simulate/deposit-cash completes the authorized deposit, and POST /cash-ins/{cashInId}/simulate/cancel cancels an authorized deposit. The endpoints replace the previous top-level POST /cash-ins/simulate/barcode-auth, .../auth-commit, and .../auth-void routes.
• Per-resource sandbox simulations for deposit addresses and virtual accounts: POST /deposit-addresses/{depositAddressId}/simulate/inbound-transfer and POST /virtual-accounts/{virtualAccountId}/simulate/inbound-transfer replace the older POST /deposit-addresses/{id}/simulate and POST /virtual-accounts/{id}/simulate routes. Both endpoints take an amount as a decimal string in whole units. The deposit-address body carries only amount (asset and network are resolved from the deposit address). The virtual-account body is discriminated by type (bankUs with network set to ach or wire, or bankIban with network set to swift) and settles synchronously for domestic rails and asynchronously for SWIFT.
• Crypto destinations on deposit addresses: DepositAddressCreateRequest.destination now accepts walletOms and walletExternal in addition to the existing bankUs, bankIban, and bankCanada bank arms. Fiat destinations produce cryptoToFiatAccount transactions; crypto destinations produce cryptoToCrypto transactions and are gated to ethereum, base, and solana. walletExternal destinations must reference a registered external account by its ext_wlt_ ID. PATCH /deposit-addresses/{depositAddressId} can re-point destination to either a bank or crypto target.
• returnWallet on deposit addresses: partners can register a crypto return destination for a deposit address at create time or through PATCH /deposit-addresses/{depositAddressId}. The registered wallet is echoed in reads when set.
• walletFiat instrument type: a new instrument arm on quote sources and transaction sides represents a customer’s fiat balance wallet held at a partner bank. QuoteSourceRequest now accepts walletFiat in addition to walletOms and card.
• Structured 422 on virtual account and deposit address create: POST /virtual-accounts and POST /deposit-addresses return 422 validationFailed with a machine-readable code and a partner-safe details.reason when the payment provider terminally rejects the create call. No resource is created when the provider rejects the request.
• PrecursorManual on transactions: transactions with no automated origin now carry a precursor of type manual with no details block, so precursor is always present on the response.

​

Updated

• sourceToDestination includes cash corridors on the union: the SourceToDestination composite tag now enumerates cryptoToCash and cashToCrypto alongside cryptoToCrypto, cryptoToFiatAccount, and fiatAccountToCrypto. The cash arms are derived from a cash pickup destination or a cash-in source.
• TransactionSubStatus.failed.returned retired: failed.returned is retired and its meaning absorbed by failed.returnComplete, which covers both operator-triggered crypto send-backs and provider-side ACH or wire bounces with clawback under one wire value. Consumers that switched on failed.returned should switch on failed.returnComplete instead.
• Sandbox tag replaces Simulation: the OpenAPI Simulation tag is retired. The new per-resource simulation endpoints group under the Sandbox tag.
• Wallet ID format: OMS wallet IDs now use the wlt_<typeID> format on responses; the legacy acc_<uuid> format continues to be accepted on requests.
• Cash-in fixedAmountSide echoed on the response: the side the amount was fixed on when creating a cash-in is echoed on CashIn.fixedAmountSide; OMS calculates the other side.

​

Removed

• Top-level cash-in simulation routes: POST /cash-ins/simulate/barcode-auth, POST /cash-ins/simulate/auth-commit, and POST /cash-ins/simulate/auth-void are removed. Use the per-resource replacements listed above.
• Generic simulate routes on deposit addresses and virtual accounts: POST /deposit-addresses/{depositAddressId}/simulate and POST /virtual-accounts/{virtualAccountId}/simulate are removed. Use the /simulate/inbound-transfer replacements listed above.
• Card create through the generic POST /external-accounts route: registering an external account of type = card through the generic create is now rejected with 422 cardMustUseCardEndpoint. card remains a valid type for reads, lists, GET, and DELETE.

​

New

• Typed instruments on source and destination: quote and transaction sides are now discriminated by type. A quote’s source is an OMS wallet (walletOms) or a debit card (card, pull-from-card funding); the destination can be walletOms, walletExternal, bankUs, bankIban, bankCanada, card, or cash. Each type carries its own details envelope with the instrument-specific fields (bank routing coordinates, IBAN block, card identifiers, cash pickup coordinates, and so on) and a party block that identifies who is on that side.
• Consolidated pricing object on quotes and transactions: per-side amounts (amountGross, amountNet, feesDeducted), the rate pair (exchangeRate, effectiveRate), the asset pair, fixedAmountSide, sponsorGas, and sponsorGasCost all move into a single top-level pricing object with pricing.source and pricing.destination per-side entries. The core equation is now pricing.source.amountNet × pricing.exchangeRate = pricing.destination.amountGross.
• precursor on transactions: a typed precursor object describes what created the transaction (quote, depositAddress, virtualAccount, or cashIn) and carries that origin’s deposit instructions. It supersedes the loose quoteId / depositAddressId / virtualAccountId / cashInId and top-level depositInstructions fields.
• hold and awaitingAction status: transactions can now enter a non-terminal awaitingAction state when blocked on developer, upstream, or compliance action. The hold object explains the reason and carries a deadline, and the transaction returns to processing once cleared. TransactionSubStatus is now a closed set of status-scoped strings namespaced by their parent (for example processing.cashPickupReady, completed.cashPickupCollected, awaitingAction.awaitingSenderAttribution, failed.attributionTimeout).
• sourceToDestination corridor tag: a new composite tag on quotes and transactions covers cryptoToCrypto, cryptoToCash, cryptoToFiatAccount, cashToCrypto, and fiatAccountToCrypto. It replaces the older type and TransferType for these resources; TransferType is retained for deposit addresses, onramp/cash-in, and customer filters.
• Party model on each side: sides now carry a party block discriminated by relationship (customer, otherCustomer, externalRegistered, externalUnregistered), so two-sided flows such as remittances and B2B payouts can identify each side inline. senderCustomerId, recipientCustomerId, and the per-request role field are removed; use customerId (the quote owner and sender) plus the party blocks instead.
• ?customerId= filter on GET /transactions: pass customerId as a query parameter to scope the list to a customer. Matches rows where the customer is on either side.
• SettlementError and operator Recovery: transactions carry a SettlementError (code, message, occurredAt, recoverable, and an optional recovery path or refund) in place of the previous generic AsyncError.

​

Updated

• Removed the “MVP” note from the customer type description: the field description now reads simply Must be "individual".
• Card settlementType field on quote requests: card rail only. internal custodies the crypto with OMS; external delivers to an on-chain wallet. Defaults are external for card buys and internal for card sells.

​

Removed

• GET /customers/{customerId}/transactions: retired. Use GET /transactions?customerId=… for the same behavior.
• Legacy top-level fields on Transaction: senderCustomerId, recipientCustomerId, role, quoteId, cashInId, depositAddressId, virtualAccountId, depositInstructions, rail, rates, sponsorGas, sponsorGasCost, fixedAmountSide, type, completedAt, and cashPickup are removed from the top level. The information they carried now lives on pricing, precursor, source/destination party, sourceToDestination, and subStatus.
• cashPickupReady top-level status: cash off-ramp pickup lifecycle events surface as sub-statuses (processing.cashPickupReady, completed.cashPickupCollected, completed.cashPickupExpired) rather than as a top-level status.

​

Updated

• Settlement jobs resume on service restart: on startup, the settlement service scans persisted settlement job ids and restarts any whose result is non-terminal, skipping jobs that already completed. Operator restarts and crash recovery no longer leave an active settlement job sitting idle until an unrelated event picks it back up (#1585).

​

New

• Debit-card buy and internal sell on /quotes and /transactions: partners reference the card by its externalAccountId (ext_…) on the quote and transaction requests and the existing pricing and transaction machinery handles the rest. Card buys produce a fiatToCrypto transaction and settle either internally or externally; internal card sells produce a cryptoToFiat transaction. A new optional settlementType field on the quote request (internal or external) is persisted on the quote and re-read at execute time. externalAccountId is surfaced on the transaction source (buy) and destination (sell) in GET and list responses and on the webhook snapshot. Source walletId is now optional for card buys, and a wallet target on a card sell is rejected. New validation errors include external_sell_unsupported, external_account_rail_mismatch, external_account_required, external_custody_not_allowed, and source_wallet_address_not_allowed (422), plus invalid_wallet_target (400). External card sell is not yet supported.
• billingAddress required for card external accounts: registering an external account of type=card now requires a billingAddress (addressLine1, city, state, country, zipCode). Missing or whitespace-only fields surface a billing_address_invalid validation error.

​

Updated

• Structured JWT authentication errors: failed bearer-token requests now return RFC 6750-style bodies with a stable machine code on error and a human-readable reason on error_description, plus a matching WWW-Authenticate: Bearer error="…", error_description="…" challenge header. Distinct codes let clients tell expired tokens (invalid_token with "token expired") from missing (invalid_request with "missing authorization token"), bad signature (invalid_token with "invalid token signature"), missing required project claims, and generic invalid tokens, so a dashboard can trigger a silent refresh on expiry instead of treating every 401 the same. A keyset-unavailable failure now returns 503 temporarily_unavailable instead of 401. Note the breaking response contract change: the top-level error field is now a stable machine code rather than free-form prose; clients reading .error as a human message need to read .error_description instead.
• Visible retry reason on transient onboarding failures: when an onboarding phase hits a transient error, the onboarding record now carries a non-terminal statusReason such as retrying after transient error (attempt N): <err>, refreshed on each retry and self-cleared once the phase advances or the onboarding reaches a terminal state. An actively-retrying onboarding is no longer indistinguishable from one that is silently stuck; terminal failures continue to record their final reason as before.

​

New

• Bor devp2p peer jailing on develop: the bor downloader replaces blanket peer drops with a graded response. Transient failures (timeouts, stalls, unsynced peers, empty headers) get a 30-second local backoff, four soft strikes in a 10-minute window escalate to a 5-minute jail, a whitelist (checkpoint or milestone) mismatch backs off then jails before dropping only after persistent disagreement within a 30-minute window, and a pruned-sidechain ghost-state mismatch jails on the first occurrence and drops only on a repeat inside a 30-minute window. Every terminal drop also benches the peer for 30 minutes so it cannot dodge the drop by reconnecting. Not consensus-affecting, fully backwards-compatible, and operator-visible through new eth/downloader/peer/response/{backoff,jail,drop,mismatch} Prometheus meters and a reason field on the existing Synchronisation failed, dropping peer log (#2283).
• Heimdall Ithaca hardfork code merged, disabled by default: a new hardfork gate adds VEBLOP pending-stall recovery so a span rotates when the agreed actual bor head stops advancing past a stall threshold, closing the post-Rio liveness hole where a stalled single block producer could halt bor production while a pending milestone tally remained in the 1/3–2/3 band. The new behavior is gated behind a per-network ithacaHeight that ships at 0 (disabled) on every network; activation heights are a release-planning decision and must be >= Rio. No stored-state migration or genesis change (#611).

​

Updated

• Erigon v3.6.1: a non-breaking optimization and bug-fix release. RPC providers are strongly recommended to upgrade ahead of the mainnet Zurich activation; nodes already running v3.7.1-priv require no action.

​

New

• L1 result lookup by settlement hash: operators can query the L1 settlement result for a given settlement hash directly, instead of re-deriving the result from local state (#1572).

​

Updated

• Gas bump on settlement retry: each settlement attempt now persists its resolved EIP-1559 fees (max_fee_per_gas, max_priority_fee_per_gas), and a replacement transaction on the same nonce bumps both fields by at least the geth pricebump floor (10%), tracking a fresh L1 estimate and respecting the configured ceiling. When the ceiling forbids a strict bump, the run loop waits on the existing ceiling-priced attempt rather than broadcasting an underpriced replacement that execution-layer clients would reject (#1580).

​

Fixed

• No reorg loop during L1 indexing lag: when a nonce is observed mined but the receipt has not yet propagated to a lagging RPC node, the settlement loop now re-checks the (wallet, nonce) mapping and treats a still-matching transaction as NotSettledYet, retrying through the existing backoff path. Only a nonce that no longer maps to the same transaction is reported as a reorg, eliminating a tight retry loop that hammered L1 during indexing lag (#1581).

​

New

• Base ETH native on all edge rails: Base ETH native is now an unconditional relay-handoff candidate on both origin and destination across every edge rail. The previous flag that gated Base-native to Solana origin only is removed; Relay quotes the pair in all four corners (EVM↔Tron, exact-input and exact-output), so suppressing it on Tron origin saved no work and hid a swap-saving candidate. The strategy race still discards candidates that fail to quote (#944).
• edgeSolanaEnabled and edgeTronEnabled on RuntimeStatus: the RuntimeStatus RPC and generated Go and TypeScript clients report per-rail edge enablement derived from config.edge.solana.enabled and config.edge.tron.enabled (#948).

​

Updated

• Edge monitor enablement is rail-aware: the edge monitor is considered enabled when either Solana or Tron edge is enabled, centralised behind Config.EdgeEnabled() so a Tron-only or Solana-only deployment starts the worker correctly (#951).
• Provider scoring uses real gas costs: Relay now reports origin-chain gas in Info() (200k gas units), Hyperlane CrossCollateral reports a 3 bps fee and 30-second duration, and Relay’s default duration moves from 10s to 30s. Capabilities() returns Supported, Trustless, and Operations from a single struct, so probe paths no longer call Info() with a zero chain ID and silently drop Relay, Hyperlane, and CCTP from candidate building (#935).

​

Fixed

• Multi-wallet connection regression on EVM and SVM: a widget regression that broke connecting both EVM and Solana wallets in the same session is fixed (#1122).
• Edge monitor queue starvation: persistent-error rows no longer cycle through POLLING → PENDING every 5 seconds (which had been resetting the 1-hour retry timeout) and starve newer edge intents behind 10 stuck rows in the dequeue. Failing origin edge quotes now park in POLLING until stale recovery or timeout, so persistent failures age out through the existing pending-edge pipeline (#949).
• Origin edge fast-retry on missing fill hash: when Relay reports terminal success before the fill or handoff hash has propagated into txHashes, the edge quote fast-retries on the next worker cycle instead of waiting for stale-recovery to time out (#953).
• Solana edge address validation: Solana origin, destination, token, and refund addresses are validated by decoding through solana-go instead of a regex shape check, so base58-shaped strings that decode to the wrong public-key length are now rejected. Token-style public keys remain valid where appropriate, but are not accepted as a user recipient or refund address (#943).
• Terminal intents clear queued child transactions: IntentReceipts.RefreshStatus aborts queued child transactions still in ON_HOLD, PENDING, or ERRORED once the parent receipt is terminal, so /info/workers no longer shows stale dependents waiting for a release that will never come. Active child transactions in RELAYING, SENT, or MINING are preserved (#940).
• Graceful-shutdown dispatch stranding: the dispatch decision in ProcessTransactions runs on a context detached from worker shutdown, so a SIGTERM landing after the dequeue claim no longer leaves an ORIGIN/DESTINATION row stuck in RELAYING until the 10-minute stale sweep. Receipt waits remain cancellable so shutdown still aborts long polls cleanly (#923).

​

New

• Cookie consent and analytics preferences: a consent banner now appears on first visit with separate toggles for product analytics and Google Analytics, and Account Settings exposes a re-openable analytics preferences entry. Analytics initialize only after consent and stop again on revoke; GA Consent Mode is updated and _ga* cookies are cleared on revoke. Wallet addresses, hashes, emails, bare hex values, ENS names, and sensitive URL substrings are scrubbed from analytics payloads before they leave the client, and contact and watched-wallet nicknames are no longer sent (#286).
• Earn deposit preflight and vault status guards: ERC-4626 maxDeposit(receiver) and previewDeposit(amount) are checked before relayer execution, capped vaults surface a friendly vault-capacity error, and a fee-balance guard blocks deposits and withdrawals where amount plus relayer fee would exceed the selected token balance. Yield vault status (entry and exit availability, capacity state, entry limits, risk metadata) is now preserved through the proxy cache, so deposits and withdrawals are disabled with a clear reason when Yield reports the vault is not accepting them. Possible fees show as informational detail-page copy, not warning badges (#285).

​

Updated

• Wallet, relayer, and EVM revert errors normalize app-wide: a vendored wallet-errors module decodes wallet, relayer, and EVM revert errors (including Error(string) and AllCapsReached()) into structured, friendly messages and is wired through send, sign-transaction, recovery, WalletConnect, Earn deposit, and Earn withdraw. Raw error details (code, name, cause, original message) are preserved for analytics and debugging while user-facing copy is clearer. Failed relayer quotes are no longer classified as sponsored or free-gas options, and a stale selected relayer ID is cleared once relayer options refresh (#291).

​

Fixed

• WalletConnect session-request handling and stale modal UX: duplicate transaction modals from WalletConnect re-delivering unresponded session_request events on every relay reconnect are de-duplicated by an in-memory seen-request set, closing the modal now bulk-deletes all pending transactions instead of triggering a close/reopen loop, pending transactions older than 10 minutes are cleaned up on WalletKit init and every 60 seconds, the sign-transaction modal opens reliably on tab focus through the document visibility API instead of the non-reactive document.hasFocus(), session-proposal unmount no longer cancels approvals that triggered a navigation, and unimplemented WC methods (eth_sign, eth_signTypedData, eth_sendRawTransaction, unsupported defaults) now reply with UNSUPPORTED_METHODS so dapps get a real error. The confirm button is also disabled until the relayer fee option is selected (#329).
• Trails history button restored in the wallet’s Trails integration (#323).

​

New

• BlockchainAsset schema: a new component that combines the chain identifier (chainId), the wire-level protocol family (protocol: evm, svm, or sui), and the token identifier on that chain (tokenId). All three fields are required when the object is present.
• BlockchainProtocol enum: evm for Ethereum-compatible chains, svm for Solana, and sui for the Sui Move VM.
• blockchainAsset field on wallets, customer wallets, transactions, and wallet balances: Wallet, CustomerWallet, TransactionSource, TransactionDestination, and the data payload of GET /wallets/{walletId}/balance now include an optional blockchainAsset object. The field is additive: existing chain and asset strings continue to be returned, so current integrations keep working unchanged.

• residentialAddress and identifyingInformation on POST /customers and PATCH /customers/{customerId}: both fields are now accepted on the public surface and persisted through to compliance review. ResidentialAddress and IdentificationDocument are exposed as reusable component schemas.
• Required fields on IdentificationDocument: type, issuingCountry, and number are now required when an identification document is supplied.
• Single E.164 phone field: the public customer schema standardizes on one E.164-formatted phoneNumber field, replacing the prior pair of country code plus subscriber number.

​

New

• Mainnet block gas limit raised to 160 million: the planned increase from 140 million to 160 million gas has rolled out on mainnet, lifting the effective execution rate to around 106.66 Mgas/s at the 1.5-second block time. This is the final scheduled step on the path to roughly 5,079 TPS using POL transfers (21,000 gas) as the unit transaction.

​

Updated

• Bor v2.8.3 stable rolled out on mainnet block producers: bor v2.8.3 was cut from a multi-iteration v2.8.3-candidate line on Amoy and promoted to mainnet block producers around June 16 to 17. The release rolls up the v2.8.3-beta fixes, including a milestone-mismatch rewind deadlock fix and the related revert from beta4.

​

New

• gasless option on useTrailsSendTransaction: integrators can opt into gasless execution directly from the React send hook.
• Hyperlane CrossCollateral routes with bridge-gas reimbursement: Hyperlane CrossCollateral is wired in as a route option, with bridge-gas reimbursement so destinations receive the expected amount.
• Timed refund leaf on 1.5 intents: v1.5 intents now include a timed refund leaf, so refunds can be claimed deterministically once the timeout window elapses.
• /info/workers queue filters and admin intent-receipt refresh: the admin workers endpoint accepts queue filters and exposes an admin intent-receipt status refresh.

​

Updated

• Wagmi 3 is the default widget integration.
• EVM-first connect ordering: the connect dialog requires an EVM wallet connection before exposing Solana wallets, matching the EVM-anchored intent model. The SVM tab is also hidden when the Solana edge is not enabled by the API.
• Auto-sync of origin and destination chains: the widget auto-syncs selected origin and destination chains with the connected wallet and the entered recipient, and improves SVM and EVM address validation.
• Balance hooks: balance hooks now take an object-shaped params argument.
• Hyperlane monitor cadence: poll interval reduced from 15 seconds to 3 seconds for faster origin-to-destination dispatch, with CrossCollateral dispatched only after the origin receipt is confirmed.
• /info/workers pending-intents speedup: the operator endpoint that lists pending intents is materially faster.

​

Fixed

• SOL pricing in Pay mode: SOL prices now resolve correctly in Pay mode.
• Chain resolution drift: chain selection no longer drifts between widget state and the underlying connector.
• Add wallet prop control: the fund-methods screen exposes a prop to hide “Add wallet” cleanly.
• CCTP supported chains: CCTP routes honor the chain_ids config to restrict supported chains.
• Hyperlane decimals: collateral checks and quote amounts normalize decimals for Hyperlane routes, and route decimal conversions are normalized across providers.
• Legacy receipts: receipts with a null deposit transaction are refreshed correctly.
• Timeouts and retries: dispatch and execution timeouts are bounded, ancient executing intents abort cleanly, and WaitIntentReceipt getLogs backoff is fixed so receipts do not stall behind RPC rate limits.
• Intent SUCCEEDED gating: intent SUCCEEDED status is now gated on destination edge delivery confirmation, with related fee and quote-path consolidation in dispatch.

​

New

• Zurich hardfork on Heimdall: v0.9.0 promotes the Zurich hardfork to mainnet. At the activation height, x/clerk switches to deterministic state-sync processing with block-height-based event visibility assigned in PreBlocker; both PrepareProposal and ProcessProposal enforce symmetric side-transaction caps (50/block) with wall-clock budgets for proposal construction (500 ms) and vote-extension generation (800 ms); checkpoint signature aggregation moves to commit-only; milestone propositions bind deterministically to the parent hash; MsgVoteProducers is restricted to the active validator set; and new ante decorators add a 16-output cap on aggregate bank transfers and 32-byte validation on MsgCheckpoint.AccountRootHash. All nodes must upgrade before their network’s activation height (Amoy 37,750,000, mainnet 47,880,000); pre-activation behavior is unchanged, no store migration or genesis change is required (#610).
• Full Heimdall↔Bor gRPC transport in Heimdall v0.9.0: opt-in via bor_grpc_flag, requires bor v2.8.3 or newer, with a startup hash-parity check across HTTP and gRPC before traffic switches. Batched milestone-proposition calls are around 4.4× faster than the HTTP path (#610).
• Bor endpoint failover with health probing in Heimdall: non-producer nodes can fail over between configured bor endpoints when health probes mark an endpoint unhealthy; failover is explicitly refused on block-producing nodes to preserve a single source of truth (#610).
• EIP-1559 L1 transactions from Heimdall: bridge submissions and other L1 transactions now post as type-2 EIP-1559 transactions with operator-configurable gas caps (#610).

​

Updated

• Bor v2.8.3 stable released: the v2.8.3-candidate branch promoted to stable after five Amoy soak iterations. Required for operators running Heimdall v0.9.0 with the gRPC transport enabled (#2272).

​

Fixed

• Parallel-EVM (BlockSTM v2) consensus correctness: three independent BlockSTM v2 vs serial-execution divergences, each capable of producing a bad block, are fixed at the core/state layer. A 7702-delegated CodePath read no longer splits across snapshot versions and poison the cross-block jumpdest cache; Exist now recognises accounts made to exist purely by a prior in-block nonce bump (sender increment or 7702 delegation clear), correctly applying the existing-account refund and avoiding the new-account CALL surcharge; and transfer-log emission now matches by BalanceOpsIdx instead of by transfer shape, so a same-sender/same-recipient/same-amount selfdestruct payout no longer steals a later transfer’s log emission point. Serial StateDB and core/vm are untouched; non-parallel nodes are unaffected (#2270).
• Heimdall proposer-local liveness on dense blocks: PrepareProposal previously sized the proposal with raw len(tx), but CometBFT validates the returned proposal using the protobuf-encoded size of Data.Txs. Under high tx-count load the proposer could assemble a batch that passed its own check yet exceeded MaxTxBytes once CometBFT re-measured it, stalling block production on that proposer. Accounting now uses the same protobuf unit CometBFT uses (#608).

​

New

• Hyperlane CrossCollateral routes: a new Hyperlane route variant covers cross-collateral cases that the standard Warp Route flow cannot, including bridge-gas reimbursement on the destination side. Routing dispatches the CrossCollateral call after the origin receipt lands so the destination side only acts once the origin commitment is confirmed (#843, #913).
• wagmi 3 as the default widget integration: the Trails widget and demo now ship wagmi 3 as the default wagmi path, with Privy and Sequence Connect using wagmi3-native provider/connector stacks and viem pinned to Privy’s peer requirement (#1102).

​

Updated

• Connect-wallet flow requires an EVM wallet before Solana: the widget’s Connect Wallet screen no longer lets users connect a Solana wallet before an EVM wallet is connected, both in the widget and in the standalone connect screen. The widget also enforces an EVM wallet before allowing the connect screen to be left (#1099, #1096).
• SVM wallet tab hidden when Solana edge is not enabled: when the API returns edges: [] for Solana, the widget hides the SVM wallet tab and all Solana wallet options, including both installable and already-detected Solana wallets (#1101).
• Hyperlane monitor polling interval reduced: the Hyperlane monitor now polls every 3 seconds instead of every 15 seconds, shortening time-to-state-transition on Hyperlane intents (#912).

​

Fixed

• CCTP chain_ids config honoured: CCTP route discovery now respects the configured chain_ids list to restrict the set of supported chains, instead of advertising chains outside the operator’s configuration (#915).
• Intent SUCCEEDED gated on destination edge delivery: an intent only transitions to SUCCEEDED once destination edge delivery is confirmed, removing a class of premature SUCCEEDED states on edge-backed routes (#893).
• Dispatch precheck ERRORED, worker interfaces, and admin transitions: dispatch precheck failures now route through the ERRORED path, worker interfaces are narrowed to the operations each worker actually performs, and admin-driven state transitions are centralised so they cannot diverge from worker-driven ones (#897).
• Ancient executing intents aborted: intents stuck in an executing state past their bound are now aborted instead of holding worker capacity indefinitely (#922).
• Timeout and retry bounds: dispatch timeout and retry handling are now explicitly bounded, preventing unbounded retry loops on transient errors (#920).
• Hyperlane decimal normalisation: the Hyperlane collateral check and quote amounts now normalise token decimals before comparing, fixing under-collateralisation false positives on tokens with non-default decimals (#917).
• Route decimal conversions normalised across the API quote path (#919).
• Legacy receipts with null deposit transaction: legacy receipts that recorded a null deposit transaction now refresh correctly through the receipt refresh path (#918).
• Fee and quote-path consolidation: a set of fee-collector and quote-path edge cases are consolidated into a single corrected path (#898).
• /info/workers pending intents: the pending-intents path of /info/workers is now substantially faster on busy deployments (#928).

​

New

• Mainnet block gas limit raised to 160M: with 1.5s blocks held, the upgrade lifts sustained throughput to roughly 5,000 payments per second at the same fee and reliability characteristics. Amoy continues at 200M for stress testing.
• Heimdall v0.9.0 mainnet release, Zurich hardfork: activates on mainnet at block 47,880,000 (approximately June 25, 2026, 14:00 UTC), with Amoy already activated at block 37,750,000 on June 17, 14:00 UTC. The fork gates a set of consensus-level changes that stay inactive until the activation height: deterministic state-sync processing in x/clerk with block-height-based event visibility assigned in PreBlocker; symmetric side-transaction caps of 50 per block in PrepareProposal and ProcessProposal, with wall-clock budgets of 500 ms for proposal construction and 800 ms for vote-extension generation; commit-only checkpoint signature aggregation; deterministic milestone-proposition parent-hash binding; MsgVoteProducers restricted to the active validator set; and new ante decorators (16-output aggregate bank-transfer cap and MsgCheckpoint.AccountRootHash 32-byte validation). Validators must upgrade before their network’s activation height (#610).
• Heimdall to bor gRPC transport (opt-in): heimdall ships full gRPC transport for the heimdall to bor channel, enabled with the bor_grpc_flag config and requiring bor v2.8.3+. Startup hash-parity check and batched milestone-proposition calls included; internal benchmarks show roughly 45% lower extendVote latency on the heaviest GetBorChainBlockInfoInBatch path versus HTTP (#610).
• Bor endpoint failover with health probing: heimdall now supports multiple bor endpoints with health-probed failover. Disabled on block producers (#610).
• EIP-1559 L1 transactions in heimdall: heimdall now uses the EIP-1559 fee market for its L1 transactions, with safe-default gas caps (#610).
• Bor v2.8.3 stable release: backwards-compatible client cut from v2.8.3-candidate after five Amoy beta iterations. Recommended for all operators ahead of the Zurich activation. Includes the milestone-mismatch rewind deadlock fix landed in v2.8.3-beta5 (#2272).

​

Fixed

• Parallel-EVM (BlockSTM v2) consensus divergences: three independent BlockSTM v2 vs serial divergences, each able to produce a bad block, are fixed at the core/state layer. (1) Per-tx CodePath read snapshot consistency for EIP-7702-delegated code, addressing the index out of range panics in validJumpdest and invalid gas used bad blocks observed on mainnet. (2) Exist now considers prior-tx nonce bumps, so applyAuthorization’s existing-account refund and the new-account CALL surcharge match serial. (3) Settlement transfer-log mispairing in tryEmitTransferAt now matches on TransferRecord.BalanceOpsIdx rather than transfer shape, eliminating the receipts-root-only divergence from EIP-6780 selfdestruct payouts. Serial StateDB and core/vm are untouched, so non-parallel nodes are unaffected (#2270).
• Heimdall proposer liveness under high tx-count load: PrepareProposal accounting now uses the same protobuf-encoded size that CometBFT uses to validate the returned proposal. Raw len(tx) could undercount per-tx protobuf overhead and let a proposer assemble a batch that passed its own check but exceeded MaxTxBytes on CometBFT’s re-measurement, stalling block production on that proposer. Proposer-local fix; not consensus-affecting (#608).

​

Updated

• Wait for any new expected (wallet, nonce) to be on L1: settlement submission now waits until any newly expected (wallet, nonce) is observed on L1, closing a race that could surface during recovery and re-submission (#1571).
• Certificate-to-settlement-job ID persistence: the state store persists the mapping from certificate IDs to settlement-job IDs through a new certificate_settlement_job_cf column family with insert-only semantics and a migration for existing databases. Certificate tasks can resolve settlement jobs directly without re-deriving the link (#1578).

​

New

• Hyperlane CrossCollateral routes: new CROSS/moonpay USDC and USDT route set across Arbitrum, Base, and Ethereum, including same-asset, cross-asset, and same-chain coverage. Uses the Hyperlane v4 CrossCollateralRouter with transferRemoteTo and quoteTransferRemoteTo. For overlapping USDC routes, CROSS/moonpay is preferred explicitly rather than by alphabetical order. Exact-input fee accounting reserves provider source-token overage and reimburses relayer-fronted native bridge gas through the origin-token collector sweep, so total fee no longer double-counts bridge gas (#843).
• wagmi 3 as the default widget integration: the Trails wagmi integration is now wagmi 3 by default in the widget (#1102).
• CCTP chain_ids config now honored: setting chain_ids under [cctp] in api.conf actually restricts the supported chains for CCTP routes, aligning behavior with every other route provider. Previously the field was declared but silently ignored (#915).

​

Updated

• Hide SVM wallet tab when Solana edge is not enabled by the API: the widget gates the SVM tab and all Solana wallet options on useSolanaEdgeActive() in addition to the adapter check. If the API returns edges: [] for Solana, the SVM tab and any detected or connected Solana wallets are hidden (#1101).
• Require EVM wallet connection before connecting Solana: the widget’s connect screen now requires an EVM wallet before allowing a Solana wallet, and the widget itself no longer leaves the connect screen without one (#1099, #1096).
• Hyperlane CrossCollateral destination dispatch latency cut by approximately 47s: CrossCollateral now releases the destination transaction as soon as the origin receipt proves the Hyperlane dispatch metadata, instead of waiting for Hyperlane API delivery visibility. Worker-owned early release replaces the API delivery wait; destination preconditions still gate execution (#913).
• Hyperlane monitor poll interval reduced from 15s to 3s: cuts average Hyperlane delivery-detection latency from roughly 7.5s to 1.5s, the largest controllable overhead on CrossCollateral end-to-end time. The 10s GraphQL HTTP timeout keeps cycles from overlapping (#912).
• Fee and quote-path consolidation: exact-input fee totals are computed per trade type in the fee calculator; gas-estimation RPCs are cached during quoting; provider fallback cascades are bounded; v1 and v1.5 protocol handlers share a single FeeCalculator instance; zero-value fees and gas are initialized for testnet chains so testnet quotes no longer hit a nil-pointer (#898).

​

Fixed

• Hyperlane cross-decimal collateral check (caused two stuck user intents): collateral sufficiency now scales the origin-denominated transfer amount to destination decimals before comparing, instead of comparing destination-denominated collateral against a raw origin transfer amount. For Polygon to BSC 6 to 18 USDC routes, raw collateral 18.45e18 was numerically larger than raw transfer amount 644e6, so an insufficient-collateral case still passed the check. Quote ToAmount and ToAmountUSD are now destination-denominated, and EXACT_OUTPUT requests are normalized back to origin decimals before quoting and packing transferRemote calldata (#917, #919).
• EVM to Solana intent completion gated on destination edge delivery: for DESTINATION-mode edge intents, WaitIntentReceipt no longer returns Done=true until the edge monitor confirms the Solana fill, failure, or refund. The intent holds at EXECUTING until the edge worker terminates, then RefreshStatus derives the terminal status (Completed to SUCCEEDED, Failed to ABORTED, Refunded to REFUNDED). A delivery bound on the bridge transaction TxnMinedAt exits the hold if the destination delivery stalls (#893).
• Timeout, cancellation, and retry hardening: CCTP now uses an http.Client with a 10s timeout instead of the no-timeout default; origin-edge success ordering calls ExecuteIntent before marking the edge COMPLETED and parks retryable failures in POLLING with the fill hash preserved; deposit validation no longer marks potentially funded deposits FAILED when shutdown cancels the retry wait, falling through to the existing fail-open provider fallback; deposit-dependent transaction release now uses a background context after the deposit is accepted, so shutdown cannot strand ORIGIN or DESTINATION rows ON_HOLD (#920).
• Dispatch precheck on guard error: when shouldDispatchToRelayer errors, the transaction transitions to ERRORED with a status reason and a retry metric, instead of being silently skipped and re-dequeued forever. Context cancellation is excluded so shutdown does not produce spurious ERRORED writes (#897).

​

New

• Zurich hard fork activation scheduled: heimdall v0.9.0-beta defines the Zurich hard fork with activation at block 37,750,000 on Amoy (June 17, ~14:00 UTC) and block 47,880,000 on mainnet (June 25, ~14:00 UTC). All validators, RPC providers, and node operators should upgrade their heimdall-v2 nodes before the activation block on each network.

​

Updated

• Bor v2.8.3 stable: non-breaking release focused on performance and stability improvements, validated through an extended Amoy testing period. No operator action beyond the standard upgrade cycle is required.
• Heimdall v0.8.2 stable: matching mainnet release of the v0.8.x line for operators that need to remain on v0.8.x ahead of the Zurich activation on mainnet.

​

New

• SP1 Hypercube (v6) live on mainnet: AggLayer mainnet recorded its first L1 settlement on the SP1 Hypercube prover on June 16, completing the v5 → v6 migration across devnets, testnets, and mainnet. The upgraded prover is up to 5x faster on proving speed, more cost effective, and brings security hardening improvements. Backward-compatible reads of legacy v5 proofs and certificates remain in place over the migration window, so no caller-side changes are required.

​

New

• Exit-certificate claimer service: a new exit_certificate_claimer HTTP service in AggKit serves the data needed to call claimAsset on L1 for the bridge exits available to an address, with helper scripts (list-bridges.sh, claim-asset.sh, claim-all.sh). The service can run standalone or derive its config from an existing exit-certificate run via --exit-certificate-config. Default port 7080 (#1650).
• Off-chain LER computation in the exit-certificate tool: Step G is split into G1 (lite L2 bridge sync) and G2 (NewLocalExitRoot computation). G2 now supports an off-chain mode that computes the LER directly from the lite exit tree without an Anvil shadow-fork, alongside the default shadow-fork verification mode. exitAddress is now mandatory and several option names switch to the ignore* convention. Config files now accept JSON or TOML (#1633).
• Settlement attempt and job persistence: settlement attempts and jobs are persisted to storage before submission to L1, so pending settlements can recover attempt metadata and job payload after a node restart (#1550, #1551).

​

Updated

• Docker image version reporting: agglayer Docker and CI builds now stamp a real git-derived version at compile time, so the node startup log prints the version instead of VERGEN_IDEMPOTENT_OUTPUT (#1568).

​

Fixed

• Stuck settled-but-InError certificates: re-certification now queries the aggchain hash at the pre-settlement L1 block instead of latest, so stateful aggchain contracts no longer revert reconciliation with L2BlockNumberLessThanNextBlockNumber() after nextBlockNumber advances past the certificate’s L2 range. L1 archive access is required on the same path that already required it (#1563).
• l1infotreesync upgrade loop: upgrading from a legacy syncer (for example 0.8.x) to the multidownloader implementation no longer leaves the syncer stuck with not found in storage or blocks_reorged. When the last-processed block is at or below the finalized block, the multidownloader validates it against L1 by hash and resumes from lastBlock+1 on a match, removing the need to manually delete the DB (#1639, #1645).
• Bare-filename config paths: agglayer accepts a bare filename config path (for example agglayer.toml) again, without requiring a parent directory (#1553).

​

New

• Unified wallet connection with SVM: the widget’s wallet connection flow surfaces EVM and Solana wallets in the same connect dialog (#1019).
• Wallet screening for quote requests: quote requests are subject to wallet screening before a quote is returned (#853).
• intents.disable_v1_intent_protocol config and GetSupportedIntentProtocols API: deployments can disable the v1 intent protocol, and the supported-protocols RPC reflects the setting (#876, #884).
• Recipient picker pulse and a same-chain WETH↔ETH calldata demo scenario in the widget (#1080, #1079).

​

Updated

• Source-token selector: shows all wallet tokens and supports API-based search inline (#1006).
• Solana wallet cancellations are retryable: cancellations from Solana wallets during signing are treated as retryable rather than fatal (#1072).
• Solana destination edge timeline: Solana destination edge transaction states are included in intent state, and duplicate edge-tx rows in the Solana edge timeline are removed (#866, #1076).
• Default connector set: select native wallet connectors are removed from the widget’s default connector set (#1068).

​

Fixed

• Mainnet CCTP routes: a testnet-mode gate that was breaking mainnet CCTP routes is removed (#861).
• Expired persisted fee quotes: dispatch now regenerates a fresh fee quote when the persisted quote is within 1 minute of its 10-minute expiry, instead of sending an expired quote and being rejected. Stuck DESTINATION transactions also time out after 1 hour rather than waiting forever and starving the dispatch queue (#868).
• Deposit starvation behind in-flight rows: the dispatch dequeue no longer includes RELAYING/MINING rows, so stale in-flight rows from crashed or restarted workers no longer block recovery or starve deposit-dependent transactions (#858).
• Same-chain calldata cases: same-chain swaps with calldata, including same-chain same-token with exact input, route correctly (#1074, #1078).
• Solana destination flows: destination token selection updates correctly, destination fills no longer double-fill, and Fund is disabled until a Solana recipient is selected when the destination is Solana (#1073, #1082, #1083).
• Edge metadata rail persistence is retained correctly on intent records (#857).
• IntentTransactionGasFee.totalFeeUsd is now typed as float64 instead of string, aligning the API contract with how it is serialized (#854).
• Widget polish: connect-wallet close button, WETH demo icons, clipboard fallback compatibility, and inline-SVG canvas rendering (#1070, #1088, #1085, #1086).

​

New

• Private Send REST flow and status UI: Private Send now runs on the REST send flow with fee quoting, order creation, deposit submission, order polling, and a five-step lifecycle and status view. Failures after the deposit hand-off are tracked as recoverable rather than fatal (#304).
• Private Send recovery: a Settings recovery surface lets a connected wallet look up saved recoverable orders, inspect stuck balances, and submit stuck-UTXO withdrawals (#306).
• Wallet screening auth gate: authenticated wallets and connected EOAs are checked against a screening service before sign-in, OAuth callback, route loaders, auth-token setup, and the experimental wallet and login routes proceed. Blocked wallets are cleared from local auth state, redirected to sign-in, and shown a blocked-wallet notice. Screening URL and key are configured via environment variables (#287).

​

Updated

• Private Send availability analytics: availability now reports unsupported_chain for non-supported EVM chains and unsupported_token for collectibles and non-coin records before checking other eligibility (#305).

​

New

• 429 response on POST /auth/token (get bearer token): the token endpoint is rate-limited per client IP. When the limit is exceeded, the endpoint returns 429 with an ErrorResponse body and a Retry-After response header carrying the integer number of seconds to wait. Clients should branch on 429 alongside 200, 400, 401, and 500 and honor Retry-After before retrying.

​

Removed

• GET /accounts/{id}/balance: the standalone account-balance endpoint is no longer part of the public API. Read balances through GET /wallets/{id}/balance instead. The AccountBalance schema is removed.
• Account tag: the Account grouping is dropped from the API. Endpoints that referenced it now live under Wallet.

​

Updated

• GET /accounts/{id}/transactions is now a Wallet operation: the endpoint is re-tagged from Account to Wallet and the summary becomes “List wallet transactions.” The path parameter id now expects a wallet ID with the wlt_ prefix. The path itself is unchanged, so existing integrations continue to work; update tooling, examples, and SDK groupings to file the endpoint under wallets.

​

New

• 502 response on POST /transactions (execute a transaction): synchronous provider failures during transaction execution now return 502 with a Transaction body in failed status, so clients can distinguish “created but failed at the provider” from “not created.” Handle 502 alongside 201 when calling the execute endpoint.

​

New

• Agentic wallet mode: dedicated landing experience with a terminal-style prompt copy flow for AI coding agents, plus an in-wallet inventory prompt card with docs link, reduced-motion support, and dismiss persistence.
• Earn interest disclosures and deposit terms: tooltip-based interest disclosures across the Earn list, detail, and deposit surfaces, with the APY column relabeled to Interest. A terms-and-conditions notice now appears below Review Deposit.
• Earn coin filters: switch between “Yours” (vaults for tokens in your inventory) and “All” to discover other opportunities, replacing the previous third “Vaults available for your funds” table.
• Inventory and empty-state defaults: collectibles are hidden by default until enabled in settings, the header wallet avatar stack is hidden when only one wallet exists, decorative placeholder cards are removed from empty states, and Earn defaults to all vaults when no coin tokens are held.

​

Updated

• Earn UX: vault data is now cached across page navigation with background refresh, sorting is available on any column with retained filters and sort order across navigation, deposit and withdraw amounts can be entered as a direct percentage, and vault selection rules now require APY under 100 percent (alongside the existing $300k minimum TVL and non-deprecated criteria) to filter out stale high-APY vaults.
• Private Send flow: refreshed UI with new step transitions, token selection, recipient selection, amount entry, and final send states.
• Terms of Use and Privacy Policy updated.

​

Fixed

• Transaction flow reliability: transaction relay and finality waiting now resolves only after a confirmed final status and handles cancellation and failure consistently; the sign-transaction modal scopes requested transactions correctly and keeps selected transactions visible while progressing; dapp send-wallet-transaction recovery handles wallet sync, duplicate approvals, stored transaction ids, the success idle state, and error rendering consistently.
• Inventory cache regressions after the persisted query cache migration: auth inventory prefetch now writes the canonical summary shape consumed by the inventory query hook, and recovery inventory reads are scoped to the requested recovery wallet, including the per-chain selection flow.
• Empty inventory notice no longer flickers when refreshing inventory.
• Earn snapshot initialization no longer gets permanently stuck if a background refresh is interrupted; the refresh lease now expires within 90 seconds and the next request re-triggers initialization.
• Private Send withdraw finalization behavior corrected.
• Trails success modal content fixed in the in-wallet cross-chain flow.
• Agentic mode terminal: text overflow fixed and generated CLI prompt arguments are now wrapped in double quotes for terminal-safe copy and paste.

​

New

• Mainnet block time reduced from 1.75 s to 1.5 s: on June 3 the network moved to 1.5-second blocks with the block gas limit held at 140 million, raising the effective execution rate from around 80 Mgas/s to around 93.3 Mgas/s. No operator action is required. As a heads-up, a follow-on block-gas-limit increase from 140 million to 160 million is currently scheduled for June 16 as the final step on the path to 5,000 TPS.
• Heimdall hard fork activated on mainnet at block 46361000: the validator-set fee-withdrawal gate hard fork activated on Polygon PoS mainnet at block 46361000 on June 2 at 14:00 UTC, with heimdall v0.8.1 as the matching public release. After the fork, fee-withdrawal operations on heimdall are restricted to addresses in the active validator set; requests from non-validators are rejected at message-handling time. The fork also activates the v0.8.x features documented in the June 1 entry (planned-downtime successor nomination, deterministic state syncs gated on visibilityTimeHeight, and the related bridge and consensus guards).

​

New

• Networks can be marked as disabled in configuration, so operators can stop accepting certificates from a chain without removing it from the deployment (#1160)

​

Updated

• Breaking: the admin API replaces forceSetCertificateStatus with forceEditCertificate, which takes a certificate ID, a process-now=true|false flag, and structured operations such as set-status,from=InError,to=Candidate or set-settlement-tx-hash,from=0x...,to=null. Update any operator tooling that called the previous endpoint (#1159)
• Breaking: prover transport is now gRPC-only. The prover_entrypoint config key is removed and the [grpc] block is mandatory; prover references a ProverType from the provers repository (#1195)
• Breaking: the [extra-certificate-signer] configuration variable is removed; drop the matching block from deployment configs (#1206)
• Default settlement confirmations raised from 1 to 12. Deployments that set this parameter explicitly are unaffected; deployments relying on the default now wait 12 blocks before processing a settlement (#1470)

​

New

• Hyperlane routes: Trails routes can now traverse Hyperlane Warp Routes, including first-party USDC HWR support across Arbitrum, Base, Polygon, Ethereum, and Katana. Hyperlane is enabled in AUTO routing with market-rate fee estimation, supports EXACT_INPUT trades, and includes destination-collateral checks, worker recovery, and underfunded-deposit refund handling.
• LayerZero Value Transfer (LZ_TRANSFER) routes: a new route provider built on the LayerZero Value Transfer API replaces the deprecated lz_stargate route. The widget exposes it as a selectable bridge option.
• Open Intents Framework (OIF) routes: OIF is wired in as a route provider, with an expired-order refund worker, explicit rejection of partial-fill quotes, and demo coverage for ETH USDC → Katana USDC.
• OMS Wallet widget theme: a new widget theme aligned with OMS Wallet, including a refreshed selected-wallet background.
• Recover funds screen: a dedicated screen in intent history for recovering stuck funds, replacing the prior inline recovery surface. Edge wallet intents are now included in history.
• Fund exact output: funding flows can now target an exact output amount.
• Recent chains in the chain selector: previously used chains surface at the top of the chain selector.
• Token selector refresh: a refresh control on the token selector reloads token lists inline.
• Widget chain and token filtering: new supportedChains and supportedTokensByChain widget props let integrators restrict the chains and tokens shown to users.
• GetEdges discovery API: a new RPC enumerates enabled edge rails so integrators can discover available cross-chain routes at runtime.
• Intent history filters: history and search now accept edge address, rail, mode, provider, and participant-address filters.
• Edge metadata on intent endpoints: intent receipts now include IntentEdgeMetadata with EdgeStatus, refund transaction hashes, and rail metadata.
• Same-chain “Swap & Receive” label: same-chain terminal swap steps are labeled clearly in transaction summaries.
• Wagmi auto-detection: the widget detects an active wagmi provider without explicit adapter configuration.
• Composable action resolver APIs: the composable-action resolver helpers are now exported for integrator use. See the Trails docs.
• Somnia chain support: Somnia is supported as a route destination, including USDC.e ↔ USDso swaps and SOMI OFT routes for cross-chain SOMI transfers, with refreshed SOMI branding in the widget.
• EVM↔Solana edge support (in QA): end-to-end EVM↔Solana intents are merged to master and available in the dev demo, with SVM wallet auto-detection, Solana-standard wallet support, Solana funding and settings rows, Solana-side refund and failure handling, and server-side edge execution via a new edge monitor worker. Targeting a follow-up SDK release once QA completes.

​

Updated

• Hyperlane fee breakdown: Hyperlane now shows as a Bridge rather than a Swap in the fee breakdown.
• WETH passthrough: self-wrap and self-unwrap quote shapes are now supported through passthrough.
• lz_stargate removed: the deprecated lz_stargate route provider has been removed in favor of LZ_TRANSFER.
• xai and blast chains removed: both chains are no longer supported by the Trails SDK.
• Widget input scope tightened: from.currency is restricted to fiat and from.token to ERC-20 in the widget.
• Multi-swap route discovery: routing now discovers multi-swap routes through intermediary tokens, broadening coverage.
• GetEarnPools chain list: refreshed list of chains exposed by the earn-pools endpoint.
• WaitIntentReceipt synthesis: receipts are now synthesized from intent state when no receipt row exists, removing a class of “pending” hangs.

​

Fixed

• Polygon USDT permit: salt-based EIP-712 domain handling now works correctly for the Polygon USDT permit flow.
• EVM signer resolution: quote requests now resolve the EVM signer address when a wallet session is connected but walletClient is still null (for example, MetaMask on Polygon before wagmi materializes the client).
• Embedded wallet approval prompt: the “Please approve…” prompt is hidden for embedded wallets, including OMS Wallet.
• Embedded wallet intent recovery: resolves a recovery hang for embedded wallets on v1 intents.
• Quote owner resolution: the connected EVM wallet is always used as the quote owner; the recipient address is never substituted.
• Quote route provider fee labels: corrected labels for route provider fees in quote breakdowns.
• Fund method disabled state: unlisted fund methods now render as disabled rather than enabled.
• WalletConnect recovery flow: the WalletConnect recovery flow now completes without stalling.
• WalletConnect funding: WalletConnect funding now redirects to token selection and exposes a disconnect button. WalletConnect wallets are also shown when direct-transfer is hidden from fund methods.
• Native wallet reconnect on reload: native wallet sessions now reconnect on page reload.
• Recovery fee options: fee options no longer break for WaaS wallets in the recovery flow.
• v1.5 depositSignature: v1-only fields in depositSignature are now guarded for v1.5 compatibility.
• Credit-card flow placeholder: fund amount placeholder text fixed in the credit-card flow.
• SDK edge sends: the SDK no longer auto-executes intents after an edge deposit; server workers handle execution.
• Same-chain quote math: fixed PriceImpactUSD, native token normalization, and EXACT_INPUT calldata for same-chain quotes.
• Edge quote timeout: intents now abort cleanly on edge quote timeout.
• Fee caps: exact-input fees are capped to the residual amount, and CollectorFeeCap is scoped to EXACT_OUTPUT to fix an EXACT_INPUT bridge gas regression.
• Edge worker transaction hashes: init and refund transaction hashes now persist correctly through worker updates.
• Token decimals cache: scoped by chain to prevent cross-chain collisions.
• Deposit transfer logs: matching deposit transfer logs are summed instead of taking the first match.
• Outer approvals: redundant outer approvals are skipped for SDK-managed hydrateExecuteAndSweep multicalls.
• Multi-swap recipients: replay of multi-swap intents now preserves the original per-step recipients.
• Fee collector: corrected fee-collector validation, tokenlist fallthrough, and receipt-state edge cases.
• Send-transaction destination context: corrected propagation of destination context for send-transaction calls.

​

Updated

• Inbound blockchain networks: the BlockchainInNetwork enum used by the deposit-address simulation endpoint (POST /deposit-addresses/{depositAddressId}/simulate) now accepts INK and SUI in addition to BASE, ETHEREUM, and SOLANA. Integrators using the deposit-address flow can now simulate inbound USDC, USDT, or USAT transfers from Ink and Sui in sandbox.

​

New

• Heimdall-to-bor gRPC transport (opt-in): every bor-facing JSON-RPC now has a gRPC counterpart, selectable per-node via bor_grpc_flag in heimdall’s app.toml against bor’s new [grpc] config section. The GetBlockInfoInBatch call used in the consensus-critical ExtendVoteHandler path is around 4.4× faster on gRPC, and the wire path allocates 50 to 67 percent fewer bytes across the seven methods. Defaults are unchanged, and heimdall performs a startup hash-parity check across both transports before continuing.
• State-sync transaction tracing: state-sync (bor bridge event) transactions are now first-class in the debug_* tracing RPCs, including debug_traceBlockByNumber, debug_traceBlockByHash, debug_traceTransaction, debug_traceChain, debug_traceCall, debug_intermediateRoots, and debug_standardTraceBlockToFile. A new wrapped tracing hook collects multiple bridge events under a single synthetic root call frame per state-sync transaction, so callTracer-class tracers see one root with N sub-calls instead of N independent traces. The legacy debug_traceBorBlock RPC method has been removed; switch any callers to debug_traceBlockByNumber or debug_traceBlockByHash.
• p2p.nosnap config flag: decouples the local snapshot tree from serving the snap/1 p2p sub-protocol. Block producers can keep the flat-state snapshot enabled for fast local reads while declining to serve snap sync to peers, which removes unnecessary network and CPU overhead on validator boxes.
• miner.disable-pending-block flag: disables the pending-block creation loop in miner/worker. RPC queries against the pending tag return nil. Intended for non-validator and serving nodes that do not need a pending block.
• Builder-phase prefetch and new metrics: the builder pipeline now runs three additional, builder-synchronized prefetch phases (upfront plan scan, per-transaction forwarding, and freed-gas overflow), reducing cache-miss costs on contract-heavy blocks. New metrics include worker/prefetch/builder_added_percent and worker/txApplyDuration/{prefetched,notPrefetched}. Additional block-building timing metrics cover prepare-work duration, pending-transaction fetch time, and the count of header-time extensions.
• Heimdall planned downtime can nominate a successor: MsgSetProducerDowntime now accepts an optional target_producer_id to nominate a specific replacement. If the target is invalid, inactive, or also down for the range, selection falls back to round-robin. Gated on a coordinated hard fork.
• Heimdall deterministic state syncs: introduces height-pinned, one-block-delayed visibility for clerk events so that during heimdall halts pending events remain excluded and all validators derive identical query results. Activation is gated on visibilityTimeHeight, which is 0 (disabled) on all networks until the next hard fork is scheduled.
• Heimdall bridge self-healing expanded: the bridge self-heal loop now recovers SignerChange and UnstakeInit events in addition to StakeUpdate, unified through a single combined subgraph query that returns the max L1 nonce across the three event types. Receipt validation now rejects reverted L1 transactions and logs emitted by unexpected contracts.
• prepareProposalBudget in heimdall: implements an explicit time budget for proposal preparation in ABCI, bounding the work the proposer can do before block dissemination.

​

Updated

• Witness filestore is now the default: the filesystem-backed witness storage is now enabled by default in bor’s CLI. Existing operators on the database-backed store continue to work; new nodes pick up the filestore without additional flags.
• Witness configuration template hint: bor packaging templates now show [witness] with enable = false instead of the deprecated top-level witnessprotocol key, which the current parser no longer consumes. Update any custom configs that still use witnessprotocol.
• rpc.batchlimit renamed to rpc.batch-request-limit: bor’s templates and example config now use rpc.batch-request-limit, matching the runtime parser. The previous rpc.batchlimit key was silently ignored, which could leave nodes on the default batch limit of 1000 unintentionally.
• cache.triejournaldirectory is now wired end-to-end: operators who set this key in config.toml now get the configured directory respected. When unset, behavior is unchanged and the journal stays under <DATADIR>/triedb.
• Heimdall pruning defaults retuned: the shipped config.toml now defaults indexer = "null" (cometbft transaction index disabled), with the pruning interval reduced from 3h to 10m and EnforcedMinRetainBlocks reduced from 2,500,000 to 2,000,000. The effect on a mainnet RPC node is around 23 GB freed at steady state and the elimination of large pruning bursts. Operators who do not use /tx or /tx_search can also reclaim around 43 GB by removing the existing tx_index.db after upgrading.
• Heimdall bridge metric rename: the three self-heal Prometheus metrics moved into the heimdallv2 namespace and follow Prometheus naming conventions. self_healing_<chain>_StakeUpdate is now heimdallv2_self_healing_stake_events_processed_total, self_healing_<chain>_StateSynced is now heimdallv2_self_healing_state_syncs_processed_total, and self_healing_<chain>_NewHeaderBlock is now heimdallv2_self_healing_checkpoint_acks_processed_total. Update any dashboards or alerts that reference the old names.
• Heimdall bridge performance: vote-extension processing now pre-fetches L1 receipts in a single batched RPC call, the root-chain listener uses an O(1) topic-to-event map instead of a per-log linear ABI scan, and the clerk mempool check uses the typed CometBFT RPC client.
• Amoy bootnodes updated: bor’s compiled-in Amoy static peer list now points at the current set of Amoy bootnodes. Operators relying on the embedded list no longer need a manual override.
• Heimdall mainnet seeds and persistent peers: refreshed to the current working set, so nodes regenerating their config pick up working peers without manual intervention.

​

Fixed

• Bor recovers from milestone-mismatch forks without manual wipe: nodes that briefly forked off the canonical chain due to a heimdall startup hiccup or span propagation gap could enter a state where rewinding required canonical-chain blocks that the downloader refused to deliver, requiring an operator to wipe chain data. The mismatch-rewind path now resyncs the canonical segment from peers while still rejecting genuine sidechain ghost-state attacks.
• Forkid wire-format change reverted: a change that included polygon-specific forks (Rio, Madhugiri, Dandeli, Lisovo, Giugliano, Chicago, others) in the eth p2p handshake forkid hash was reverted because changing the wire forkid is a breaking peer-to-peer change. Nodes running the changed code could not handshake with older bor peers. A future, coordinated rollout will reintroduce the fix gated on a fork block.
• eth_estimateGas no longer fails on non-validator nodes: nodes whose configured signer is not in the active validator set previously returned “insufficient funds for transfer” against the pending block because Prepare() was failing on every block and the pending snapshot was never refreshed. Prepare() no longer fails for unauthorized signers; Seal() continues to reject blocks from unauthorized signers independently, so no invalid blocks can be produced.
• Live tracing no longer conflicts with the miner: bor running with live tracing enabled could call live tracing hooks from the miner path once it reached live, causing problems. The miner now disables the tracer in its vm.Config so only block synchronization invokes the tracer.
• Heimdall checkpoint submission off-by-one fixed: the bridge stopped submitting checkpoints to L1 after the indexer = "null" migration because the new tx-bytes lookup was passing the event’s block height instead of the height of the block that contained the checkpoint transaction. The lookup now uses height - 1, matching the invariant established by the side-tx post-handler running in the block after the one that included the message.
• Heimdall producer downtime span off-by-one fixed: veBlop spans created by PostHandleSetProducerDowntime were one block longer than intended (6,401 instead of 6,400), causing overlaps with adjacent spans. Gated behind producerDowntimeSpanFixHeight to preserve pre-fork behavior.
• (*Header).GetValidatorBytes no longer panics on short Extra: an exported helper used by indexers, light clients, and explorers panicked with slice bounds out of range when passed a header whose Extra field was shorter than 97 bytes on pre-Cancun configurations. The pre- and post-Cancun branches now share a single length guard and return nil for malformed input.
• Witness size recovers when filesystem metadata and DB disagree: if a crash interrupted a witness write between renaming the file on disk and writing the size key to the DB, witness pagination paths could silently fail because ReadWitnessSize returned nil. The lookup now falls back to os.Stat on the witness file when DB metadata is missing.
• Miner state-machine wedges closed: four silent stall paths in the producer state machine that could leak the pendingWorkBlock or pendingTasks map entry on edge cases (peer count zero during production, syncing-check early return, sealhash interrupt, full resultCh) are now plugged, with regression tests for each.
• SpanStore.PurgeCache no longer races its own poll loop: a background poller could write a freshly purged span back into the cache before the next test read, producing intermittent CI flakes. The poll goroutine is now cancelled and waited on before state is reset.
• Milestone websocket subscriber shuts down cleanly: the heimdall milestone subscriber outlived chainDb.Close() because it was launched with context.Background(). It now exits on the bor close channel, eliminating the burst of pebble: closed errors during shutdown.

​

New

• SP1 prover upgraded to v6 with backward-compatible reads of legacy v5 proofs and certificates, improving proof generation and verification performance during the migration window (#1525, #1545)
• gRPC ingress now rejects certificates carrying non-writable SP1 proof versions with a dedicated UnsupportedProofVersion error instead of failing downstream (#1522)
• Settlement service gains an auto-retry helper (retry_callback_until_success) that recovers from transient RPC errors instead of panicking (#1476)
• aggkit exit-certificate tool: Step A is split into A1 (tracing) and A2 (receipt-recovery fallback), addressable individually or together via --step a1, a2, or a, with automatic migration of legacy output files (#1630)
• aggkit exit-certificate tool: new stepAWindowSize option (default 5000) for independent Step A chunk sizing, and an abort-on-error mode that stops all workers on the first trace failure when ContinueOnTraceError=false. Trace errors now surface both the transaction hash and the underlying RPC message (#1629)
• aggkit exit-certificate tool: targetBlock accepts finality keywords (LatestBlock, FinalizedBlock), decimal/hex values, and relative offsets like LatestBlock/-10. The resolved block is persisted and reused across resumed runs (#1627)
• aggkit LET operator tooling: new craft-cert, send-cert --no-db, cert-status, and export-cert-exits subcommands, with stronger fallback diagnostics when aggsender bridge-exit data is unavailable (#1616, #1570)
• aggkit RPC client: new BatchBlockHeaderRetrieval option lets operators disable batch header requests and fall back to sequential calls for nodes that do not support batching (#1601)

​

Updated

• Per-epoch certificate rate limiting is restored: MAX_CERTIFICATE_PER_EPOCH and epoch-capacity gating in NetworkTask once again enforce one certificate per network per epoch (#1514)
• aggsender startup recovery now requires a manual database wipe when local certificate state diverges from AggLayer, replacing the previous automatic reconciliation (#1570)
• aggkit docs now document that event logs must be available from genesis and provide reth configuration for disabling receipt pruning to prevent historical sync failures (#1610)

​

Fixed

• aggkit exit-certificate tool now patches ERC-20 balances correctly for smart-contract-locked exits in Step G, supporting both OpenZeppelin v4 (slot 0) and v5 (namespaced storage) layouts. Resolves ERC20InsufficientBalance errors during SC-locked exit processing (#1622)
• aggkit Docker images now embed VERSION, GITREV, and GITBRANCH build metadata, so docker run aggkit version reports the correct values instead of empty fields (#1619, #1621)
• aggkit l2gersync no longer emits ERROR-level logs for max-block-range responses that are already handled by automatic chunking (#1607)
• aggkit ParseMaxRangeFromError now recognizes the query exceeds max block range RPC error format, so ClaimSyncer retries with chunked requests instead of failing (#1589)
• aggkit bridge-call matching now filters debug trace frames to actual CALL operations only, ignoring DELEGATECALL, STATICCALL, CALLCODE, and untyped frames (#1609)
• Pending certificate validation now uses the correct error type instead of CertificateCandidateError::UnexpectedHeight (#1289)

​

New

• Composable Actions: chain multiple destination calls into a single intent, with dynamic balance routing and support for multiple ERC-20 tokens in dynamic-amount slots. Integrators can sequence approvals, swaps, and custom calls inside one quote, with backend validation rejecting ambiguous recipient or passthrough configurations. See the Trails docs for usage.
• Token-first widget destinations: widgets now accept token-specific destination lists, letting you configure a fixed set of destination tokens (and chains) that users can pick from. Persisted token selections survive across sessions.
• Quote auto-refresh: expired quotes refresh automatically on the next user interaction before signing, so users no longer see an “Intent quote has expired” error in the pre-signing state. Refresh is suppressed once signing has begun.
• Wallet runtime adapters: Trails wallet runtimes are now decoupled behind explicit adapters, giving integrators a cleaner extension point for embedding custom wallet stacks.
• Configuration validation and offline recovery: intent configuration is now validated up front and cached locally, with pruning of stale entries. This enables offline recovery of in-flight intents.

​

Updated

• Widget lifecycle callbacks renamed: onSwapComplete, onPaymentComplete, onFundingComplete, and onWithdrawComplete are now onSwapSuccess, onPaymentSuccess, onFundingSuccess, and onWithdrawSuccess for consistency. Update your widget props to match the new names.
• WalletConnect: improved QR rendering, deep-link handling, and loading state in the WalletConnect flow.
• Quote input: clearer error states when the input amount or token is invalid.
• Send flow: destination chain now defaults to the connected wallet’s chain when no destination is specified.
• Mesh exchange: mesh exchange queries can now run without a configured trailsApiUrl.
• Receipt step ids: receipt step ids are now stable across renders, making them safer to use as React keys and analytics identifiers.
• SDK packaging: improved compatibility with Node environments and better tree-shaking for smaller bundles. Server-side rendering with Trails actions is now safe.

​

Fixed

• Fixed swap funding method selection so the chosen method is preserved across re-renders.
• Fixed the receiver token picker losing account context when switching accounts.
• Fixed chain-switch detection in the widget when users change networks mid-flow.
• Fixed Privy wallet modes incorrectly rendering a ConnectKit button.
• Fixed useQuote so QuoteError is available as a runtime value rather than a type-only export.
• Fixed missing deposit transaction enrichment in intent history.
• Wrapped errors now propagate via Error.cause, preserving the original stack and context for debugging.
• Composable-action quotes now reject a top-level recipient (which is per-call only) and omit the quote recipient in earn mode.
• Guarded against undefined details in UnknownRpcError checks to prevent spurious crashes.
• Removed a duplicate Pay fallback path that could double-trigger the pay flow.

​

New

• gRPC ingress now rejects certificates carrying non-writable SP1 proof versions and returns a structured UnsupportedProofVersion error, giving integrators explicit feedback when submitting proofs built with unsupported versions
• BatchBlockHeaderRetrieval is now configurable in [L1NetworkConfig.RPC] and [Common.L2RPC] in aggkit; set to false to disable batch RPC requests for endpoints that do not support them (v0.10.0-rc3)

​

Fixed

• Node process no longer panics on corrupt certificate rows; storage decode failures now surface as CodecError::Serialization instead of unwinding the process
• Pending certificate validation now returns the correct error type; previously reused CertificateCandidateError::UnexpectedHeight for a case it was not designed for
• ClaimSyncer now recognizes the “query exceeds max block range” RPC error and automatically retries with smaller block ranges, preventing sync failures on restrictive RPC endpoints (aggkit v0.10.0-rc2, v0.8.3-rc2)
• Bridge and claim sync debug traces now correctly match only CALL frames, preventing incorrect calldata extraction from DELEGATECALL, STATICCALL, or CALLCODE frames (aggkit v0.10.0-rc3, v0.8.3-rc3)

​

New

• Batch block header retrieval is now configurable via RPCClientConfig in aggkit, letting operators control how many block headers are fetched per RPC call (v0.10.0-rc3)

​

Fixed

• Pending certificate validation in agglayer now returns the correct error type; the code previously reused CertificateCandidateError::UnexpectedHeight, which is semantically reserved for epoch-context candidate certificates
• aggkit no longer emits a spurious error log when l2gersync encounters a block range that exceeds the RPC provider limit (v0.10.0-rc3)
• Bridge call matching in debug traces is corrected (aggkit v0.10.0-rc3, v0.8.3-rc3)
• aggkit now parses query exceeds max block range responses from RPC providers and retries with a reduced range instead of surfacing an unhandled error (v0.10.0-rc2, v0.8.3-rc2)

​

New

• PIP-86 recalibrates CHECKPOINT_REWARD on the L1 StakeManager to hold annual POL emission at the 1% target (103,530,000 POL/yr) as Polygon Chain transitions to faster block times. The parameter decreases from 34,695.98 POL to 29,414.92 POL per checkpoint when block time moves to 1.75s (planned May 5), and to 25,212.79 POL per checkpoint at 1.5s (planned May 19). No contract upgrades are required; both changes execute via updateCheckpointReward() through the existing Governance contract.
• PIP-87 proposes a fixed-cost payments program that gives payment companies predictable, fiat-denominated pricing for blockspace on Polygon. Revenue from the program is converted to stablecoins and distributed to validators and stakers via the existing PIP-65/82/85 framework, with a portion used to buy POL from the market for staker distribution and for the PIP-24 burn.

​

New

• Added miner.disable-pending-block config option to disable the pending block creation loop; when set, all pending block RPC queries return nil

​

Updated

• RPC gas cap is now bypassed only for internal system transactions; external eth_call and simulation requests are subject to the configured gas cap
• Private transaction relay now purges stale transactions more aggressively using per-block-producer error tracking, preventing unbounded in-memory growth under sustained relay load

​

Fixed

• eth_simulateV1 is re-enabled in v2.7.2; a context propagation error in the RPC path was causing the method to return incorrect results
• Fixed exponential memory growth in the pathDB BFS preload path: the node-child enumeration was enqueuing all 16 nibble children regardless of node type, causing the visited map to grow as O(16^depth) and consuming up to 14 GB per goroutine on restart, stalling block import for up to two hours on archive and full nodes
• Go runtime updated to 1.26.2, resolving 6 standard library CVEs in crypto/tls and crypto/x509 including a TLS 1.3 KeyUpdate denial-of-service and several certificate validation bypass issues

​

New

• Intents now support gas fee option selection. Specify fee options at quote time; the API validates the selected option against quoted options before execution, giving integrators explicit control over transaction costs.
• Wallet configuration is now stored at quote time and returned with the quote response, enabling reliable intent recovery and re-execution across sessions.

​

Fixed

• Recovery now correctly applies custom address overrides when deriving wallet context, preventing derived-address mismatches for intents configured with non-default addresses.

​

New

• The SDK now automatically resolves the best intent protocol version for each transaction. An explicit override, global config, or SDK default is checked in order, with a fallback to the API-provided default when the preferred version isn’t supported.

​

Updated

• The widget highlights the recipient address when it differs from the sender, making it easier to spot send-to-other flows before confirming.
• Expired quote errors now show a warning icon and offer a clear recovery path so users can retry without restarting the flow.

​

Fixed

• Fixed an issue where the recipient address could go stale after switching wallets in the widget.
• Fixed the add-wallet flow in the recipient selector so users can successfully add new recipient addresses.

​

New

• Added opt-in EVM execution optimization via --switch-dispatch CLI flag or EnableSwitchDispatch config option, introducing a fixed-size opcode stack and a switch-dispatch fast path for hot opcodes ported from GEVM

​

Updated

• Tuned PebbleDB write path (1 MiB BytesPerSync, adaptive compaction) and increased PathDB state buffer to 2 GB with intelligent carry-over across flushes, reducing write stalls for archive and full nodes
• Removed legacy UpdateDeps/GetDep DAG algorithm from BlockSTM, fully replaced by the DepsBuilder implementation

​

Fixed

• Fixed goroutine leaks in the witness request path that caused unbounded memory growth when peers disconnected during parallel stateless import

​

Fixed

• Claim syncer now determines its starting block from the earliest settled reference block (not the latest) when the database is empty on startup, preventing sync errors on fresh starts

​

Updated

• Increased max transaction packet size from 100 KB to 1 MB, improving transaction propagation between peers
• Reduced SRC buffer from 500ms to 100ms, allowing block producers to spend more time on transaction execution

​

Fixed

• bor_getLogs and bor_getLatestLogs now correctly return state-sync logs from blocks produced before the Madhugiri upgrade
• Prometheus _count metrics no longer reset to zero on each scrape, restoring correct rate(), increase(), and latency calculations for node operators

​

New

• Added end-to-end private send flow, including a dedicated status screen for deposit, withdraw, success, and failure states, and refreshed gas and privacy fee display with up to 4 decimal place precision
• Added Yield vault support to the Earn tab

• Default confirmations for L1 settlement increased from 1 to 12. Deployments that do not set this value explicitly are now safer by default.

• Added intents.disable_passthrough_quotes option. When set, the API omits passthrough quotes from intent results, giving integrators tighter control over which quote sources are returned.