What changed.

What's New

• Signer: governance module. Adding or removing a signer now needs approval from a threshold of signers, and no single node can change the signer set on its own.
• Signer: a removed signer stops counting toward signing immediately.

Security

• Signer: stricter checks on withdrawals and auction payouts, verified against the Bitcoin chain before signing.
• Signer: key generation and resharing hardened.

Improved

• Signer: upgraded to cb-mpc v0.2.2, Coinbase's threshold signing library.
• Signer: signer consoles rebuilt around the governance module.
• Relayer: a deposit whose Bitcoin transaction has been seen stays open for about a day while it confirms.
• Relayer: loan creation retries temporary failures automatically.
• Relayer: deposit status shows the reason when a loan can't be created, such as a short deposit.
• Relayer: more reliable withdrawal tracking and liquidation checks.

Infrastructure

• Relayer: runs with a standby, so updates and failures hand over in seconds.

What's New

• Liquidity availability alerts. Draws that can't go through for lack of liquidity are recorded, and you're emailed when liquidity returns. Standing requests are re-confirmed periodically; unconfirmed ones expire.
• Notification opt-out now applies to push as well as email.

Improved

• Bitcoin confirmation work runs on its own schedule and no longer holds up event processing.
• Event ingestion can't skip a failed event, and one unprocessable event no longer halts it.
• Push notifications are queued separately, so a slow provider doesn't delay on-chain work.
• Steadier log polling against the RPC gateway.

Fixed

• Repayment no longer fails its deposit authorization check.
• LTV errors decode accurately, so a rejected draw reports the real reason.
• Collateral sync is held while a credit line extension is pending.

What's New

• Security and stability improvements.

Security

• Sign-in sessions are now encrypted on the device.
• The app ignores external links from untrusted sources.

Fixed

• Vault activity now labels liquidated collateral correctly.

What's New

• Push notifications support.

Improved

• Borrow SDK: improvements and bug fixes.
• Signer: cleaner signing error messages.
• Signer: API URLs cleanup.

Security

• Relayer: security hardening and improvements.
• Signer: validation types hardened, so every action passes its policy checks before it is signed.
• Signer: security improvements on reshare.

What's New

• DCN managed lender allocation. Credit lines and draws are backed by a specific set of lenders attested by the DCN, not a global queue.
• Partial withdrawals from a fixed market. Take out part of a position and keep the rest allocated.
• Withdrawal replacement. A queued exit hands the locked allocation to replacement lenders and returns the exiting lender's funds to the flexible market.
• Cancel a pending withdrawal request yourself.
• Earn Dashboard: new withdrawal flow covering partial withdrawals, pending requests, and cancellation.

Improved

• Each fixed market keeps an allocation ledger of the lenders backing it, unwound most recent first.
• Preview how an allocation splits across lenders before submitting.
• Withdraw all funds from the flexible market in a single call.

Security

• Signer: new validation types for lender selection, replacement, and withdrawal processing, so every allocation action passes DCN policy checks before it is signed.
• Signer: allocation data is read behind a freshness check and fails closed if it is stale.

Infrastructure

• Liquidity pool, vault manager, and auction house upgraded on Base mainnet, with a new indexer tracking the allocation ledger and withdrawal queue.

What's New

• Better checks for liquidity availability before borrowing.
• Minor UX improvements and enhancements.
• Bug fixes and performance improvements.

Security

• Relayer: improved privacy so users can only access their own loan activity and requests.
• Relayer: strengthened account authentication and transaction safety.
• Relayer: stronger validation to reduce failed or invalid requests.

Improved

• Relayer: improved transaction reliability.
• Relayer: improved tracking for collateral sync and credit-line refresh requests.

What's New

• Extend credit line. A borrower can request an extension with a single signature before the term ends, and the credit line restarts for another 12 months. Extensions require at least 15% LTV headroom below the liquidation threshold.
• On-chain credit line terms. Every credit line now records its end date on-chain, anchored to the Bitcoin block of the vault's first deposit. All existing credit lines were backfilled and verified against their original deposits.
• Delinquency settlement. A credit line that ends its term with debt outstanding enters a 7-day settlement window where the debt is settled through an auction. Only the collateral needed to cover the debt is sold; any remaining BTC stays claimable by the borrower.

Improved

• The credit line term stays anchored to the original deposit through partial withdrawals and added collateral, so moving collateral never shifts the end date; only a completed extension does.
• Repayment stays available while an extension request is pending.

Security

• Signer: exit-block validation against the vault's first Bitcoin transaction, so a credit line term can't be set or extended from the wrong anchor.
• Signer: new validation types for the delinquency parameters (settlement window and buyer incentive), so parameter changes pass the same DCN policy checks as signing flows.

Security

• Signer: certificate fingerprint binding over mTLS, strengthening signer/client identity verification so a valid certificate can't be reused outside its expected identity context.
• Signer: hardened validation around auction-buy flows.
• Signer: new SensitiveBytes wrapper for sensitive byte data, redacted from logs by default and zeroized in memory on close to reduce the risk of secrets lingering after use.

Improved

• Relayer: auction buyers now receive BTC collateral directly from the related credit line's vault once an auction purchase is detected, making settlement more direct and better aligned with the purchased collateral amount.
• Relayer: better Bitcoin fee handling, with more accurate transaction size estimates for vault sweeps, improved fee calculation with better change and dust handling on auction payouts, and a lower fallback fee rate when external estimates are unavailable.
• Relayer: more reliable liquidation processing.

Fixed

• Relayer: removed legacy liquidation completion steps from the active flow, reducing duplicate or unnecessary settlement actions.

What's New

• Adaptive interest-rate curve on the variable market. The curve now pivots on an anchor (the rate at the 90% utilization target) that drifts up when the pool stays busy and down when it stays quiet, so borrow pricing tracks real demand instead of a fixed spread.
• Borrow-share accounting for credit lines. Each credit line now holds borrow shares of the pool total, so interest compounds smoothly across every credit line in a single pool update rather than being rewritten line by line.

Improved

• Minimum and maximum borrow APR are now derived from the live anchor (floor at anchor ÷ 4, ceiling at anchor × 4, capped at 18%) instead of fixed values, so the displayed range moves with real conditions.
• Repayments burn the matching borrow shares, and a full repayment always clears a credit line to zero.

Security

• Signer: TLS 1.3 now required as the minimum across the mTLS transport.
• Signer: hardened the native code boundary with length guards, in-memory secret wiping, and safer buffer handling.
• Signer: KMS key material wiped from memory on shutdown.
• Signer: HTTP header read timeouts to resist slow-request (Slowloris) attacks.
• Relayer: stricter validation on all API requests, with clearer error responses.
• Relayer: stronger Bitcoin key handling.

Improved

• Signer: PSBT-first design for Bitcoin operations.
• Signer: sparse-index support for non-contiguous party indices.
• Relayer: streamlined Bitcoin transaction signing, consolidated into a single, more secure flow with legacy signing paths removed.
• Relayer: more accurate health monitoring using on-chain data.
• Relayer: reduced internal dependencies in the health check flow.
• Relayer: request logging added for better observability into service activity.

Fixed

• Relayer: fixed an edge case in collateral synchronization during loan updates.

Infrastructure

• Relayer: migrated to a more robust, higher-performance database backend.

What's New

• Support for partial withdrawals.
• Minor UX optimisations and enhancements.
• Bug fixes and performance improvements.
• Security improvements.

Security

• Relayer: global per-IP rate limiting.
• Relayer: stricter BTC withdrawal validation, with safe retries on transient RPC failures.
• Relayer: configurable auth modes, with backwards compatibility for existing clients.
• Signer: mTLS now required for operational endpoints.
• Signer: validator hardening, including RPC error handling and user authenticity checks.
• Signer: audit logging across all operations.

Improved

• Relayer: removed unused API surface.

Infrastructure

• Signer: upstream rebase and dependency updates (Go, OpenSSL, Next.js).

What's New

• Reliable collateral sync after a direct BTC deposit to your vault.
• Interest accrual fix on the lending contract.
• UI refinements and bug fixes throughout the app.