CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.
Exceptions are the API server and WASM bindings, which have their own changelogs.

API server changelog

WASM bindings changelog

The format is loosely based on Keep a Changelog.

[Unreleased]

Changed

• Node:

  • node-daemon and node-gui: the "reckless" mode of the chainstate database is now enabled by default during the initial block download or bootstrapping, which significantly increases its speed at the cost of a potential db corruption if the system crashes in the meantime; the node automatically switches back to the normal mode of operation when the download/bootstrapping finishes.

• Node CLI:

  • boolean node options now require an explicit true/false value (e.g. --enable-db-reckless-mode-in-ibd true) instead of working as value-less flags; the corresponding environment variables (ML_NODE_* for top-level options and ML_MAINNET_NODE_* / ML_TESTNET_NODE_* / ML_REGTEST_NODE_* for per-network ones) likewise now require an explicit true/false value. This makes the absence of an option distinguishable from an explicit opt-out, so a value from the configuration file is no longer silently overridden by the command line or the environment. corresponding ML_NODE_* environment variables likewise now require an explicit true/false value. This makes the absence of an option distinguishable from an explicit opt-out, so a value from the configuration file is no longer silently overridden by the command line or the environment. --enable-db-reckless-mode-in-ibd true) instead of working as value-less flags; this makes the absence of an option distinguishable from an explicit opt-out, so a value from the configuration file is no longer silently overridden by the command line.

[1.4.5] - 2026-11-10

Added

• Node:

  • Per-peer fork download budget in the block sync manager: after initial sync, each peer may download a bounded number of header lists per refill interval (defaults: 2000 downloads, 600 seconds), tip-anchored lists included and initial sync exempt. Requests beyond the budget are deferred without punishment and retried at the next refill, which bounds the cost of adversarial fork announcements.

• Wallet:

  • A read-only MCP server for the wallet RPC daemon (new mcp-server crate, stdio transport), allowing MCP clients to inspect wallets. The server validates the MCP protocol envelope and tool arguments, bounds requests with a timeout, and resynchronizes the stream after an oversized message.

• Wallet CLI:

  • Commands are reorganized into a nested grammar (for example wallet create, staking pool create). The previous flat command names keep working, but are hidden from help and tab completion.
  • Command results carry a machine-readable payload alongside the human-readable text; wallet-cli exec JSON output reflects the command payload.
  • Interactive wizards for complex commands, gated on an interactive terminal.
  • Destructive commands go through a confirmation gate.
  • The choice to store or only display the seed phrase at wallet creation is now an optional flag.
  • Block generation asks for confirmation first.

Security

• Wallet:
  • Password file handling hardened: the file size cap is enforced before reads, the size race between stat and read is closed, and unverifiable password sources fail closed instead of falling back silently.

[1.4.4] - 2026-10-31

Added

• Node:
  • The orphan pool now enforces a per-peer capacity limit for remote orphans: peers reached through outbound connections get a larger orphan quota, eviction honors per-peer reservations, occupancy is tracked per origin, and the new quota fields are exposed through the mempool config RPC.

Fixed

• Node:
  • Orphan pool hardening: stale orphans are rejected before insertion and expiry takes priority over capacity during admission, the first-recorded origin class stays authoritative, the outbound tier is honored by eviction reservations, quota configuration is validated, and zero-count origin statistics are purged on teardown.
• Wallet:
  • Remote orphan quota rejections are classified as transient errors instead of permanent failures.

Security

• Node:
  • Advisory-exposed dependencies were patched (rustls-webpki, webpki-root-certs, tokio) and the cargo-vet imports refreshed.

[1.4.1] - 2026-09-25

Added

• Node:
  • Added PoS seal indexing infrastructure: duplicate-proof evidence storage for block seals, active by default, with a chainstate configuration option to disable it.

Fixed

• Wallet:
  • Fixed an issue where standalone-add-watch-only-address, standalone-add-private-key-from-hex and standalone-add-multisig (and the corresponding RPC methods) would reset the wallet to genesis but never perform the announced rescan; the rescan is now done before the command returns. Previously, in wallet-cli non-interactive mode the process would exit before the background rescan could run, leaving the wallet stuck at genesis so that every subsequent wallet open had to rescan the whole blockchain.

[1.4.0] - 2026-07-09

Added

• Wallet:

  • Added support for Ledger hardware wallets (beta).

• Wallet RPC:

  • New value ledger in the hardware_wallet option for wallet_create, wallet_recover and wallet_open methods.

• Wallet CLI:

  • wallet-create/wallet-recover/wallet-open support the ledger subcommand, in addition to the existing software and trezor, which specifies the type of the wallet to operate on.

• Node:

  • New options to control the newly introduced mempool cluster limits: --mempool-max-cluster-transaction-count and --mempool-max-cluster-size-bytes.
  • New RPC method mempool_get_config, which returns the current mempool configuration.

Changed

• P2p:

  • Various improvements to transaction announcement:
    • Local transactions that were already announced but never sent to any peer will now be re-announced after a few minutes.
    • Adding an already existing relayable local transaction to the mempool will cause p2p to re-announce it.
    • Transactions are now announced in batches at irregular intervals (previously, a random delay was added before each individual transaction announcement).
  • Security improvements:
    • The number of pending inbound connections is now limited.

• Mempool:

  • Various optimizations were made.
  • There are now limits on how big a single mempool transaction cluster can be (a cluster is a set of unconfirmed transactions that depend on each other); the mempool will reject transactions that would result in the formation of a cluster that exceeds the limits. The default cluster limits are: max 64 transactions, max 100'000 bytes in total.

• Consensus:

  • Tightening of certain consensus rules have been implemented, in particular:

    • When changing token metadata URI, the URI can no longer contain arbitrary characters (the restrictions are the same as when a token is created).
    • Transferring or burning zero amount of a token is no longer allowed.

    The actual consensus tightening will happen after a soft fork. The testnet fork height was set to 787640. The mainnet fork height is yet to be decided.

• Node RPC:

  • The method mempool_transactions now returns transactions in the same order in which they were originally inserted into the mempool, rather than sorting them by descendant score.

Fixed

• Mempool:

  • Fixed an issue where the mempool wouldn't track non-UTXO dependencies between transactions, which could prevent e.g. several token management transactions from being included in the same block.

• Wallet:

  • Fixed an issue where wallet transactions would remain marked as in-mempool after reopening the wallet when they are actually no longer in the mempool.

[1.3.1] - 2026-06-03

Fixed

• Wallet:
  • Fixed wallet handling of V1 order command conflicts, allowing confirmed ConcludeOrder and FreezeOrder transactions to replace conflicting unconfirmed order transactions correctly.
  • Fixed an issue where the wallet in cold mode would always use input commitments v0, thus producing signatures that may no longer be valid at the current height.
  • Fixed an issue where the wallet in cold mode would still try to access the mempool, which would cause wallet-cli to print lots of error messages like "Method is not available in cold wallet mode".

[1.3.0] - 2026-04-09

Added

• Node RPC: new methods added - chainstate_tokens_info, chainstate_orders_info_by_currencies.

• Wallet RPC:

  • new methods added: node_get_tokens_info, order_list_own, order_list_all_active, utxo_spend.

• Wallet CLI:

  • the commands order-create, order-fill, order-freeze, order-conclude, htlc-create-transaction were added, mirroring their existing RPC counterparts.
  • other new commands added: order-list-own, order-list-all-active, utxo-spend, htlc-generate-secret, htlc-calc-secret-hash.

• Wallet:

  • Now the wallet subscribes to events from the Mempool to include not yet confirmed transactions relevant to this wallet.

• Node:

  • new options added:

    • node-daemon:
      • --import-bootstrap-file - import a bootstrap file on start (previously bootstrapping was only available via node RPC).

    node-daemon and node-gui:

    • --enable-db-reckless-mode-in-ibd - this enables the "reckless" mode of the chainstate database during initial block download or bootstrapping, which significantly increases its speed at the cost of a potential db corruption if the system crashes in the meantime.

Changed

• Wallet RPC:

  • wallet_info: the structure of the returned field extra_info was changed.
  • create_order, conclude_order, fill_order, freeze_order were renamed to order_create, order_conclude, order_fill, order_freeze.

• The format of PartiallySignedTransaction was changed again.

• Node RPC:

  • The result of chainstate_order_info now also indicates whether the order is frozen.

  • chainstate_pool_decommission_destination now returns a bech32 string instead of a hexified destination (note that in the generated documentation its result was already incorrectly designated as "bech32 string"; now the description is correct).

  • Documentation-only changes:

    • Certain parameters that were designated as "string" are now designated as "bech32 string".

• Node:

  • The now redundant option min_max_bootstrap_import_buffer_sizes was removed from chainstate config.
  • The option --clean-data is now a top-level option, i.e. instead of writing node-daemon testnet --clean-data you have to write node-daemon --clean-data testnet.

• Node bootstrapping:

  • The format of the bootstrap file was changed and the legacy format is no longer supported.

• P2p:

  • The logic of initiating new outbound connections has been improved to prevent the node from constantly attempting to re-establish a connection with a peer that has banned it.

Fixed

• P2p:

  • When a peer sends a message that can't be decoded, it will now be discouraged (which is what is normally done for misbehaving peers) and the node won't try connecting to it again.
    Also, the peer will be sent an appropriate WillDisconnect message prior to disconnection.

  • Fixed a potential indefinite stalling of a particular connection when both nodes start sending large amounts of data to each other.

  • Fixed a potential indefinite exchange of the same header list requests and responses if the node and the peer are on different branches of a deep fork (such as the one happened due to the recent hard fork).

• Wallet CLI and RPC: the commands account-utxos and standalone-multisig-utxos and their RPC counterparts now return correct decimal amounts for tokens with non-default number of decimals.

• Node RPC:

  • chainstate_order_info will no longer fail if one of the order's balances became zero.

  • Documentation-only changes:

    • Certain parameters and/or returned values that were previously (incorrectly) designated as "hex string" are now designated as "hexified xxx id".

    • Parameters and/or returned values having the "plain" Destination type were incorrectly designated as "bech32 string", while in reality they are "hexified destination".

• Node bootstrapping:

  • Fixed a bug where importing a bootstrap file would truncate the file to zero length instead of actually importing it.

  • Importing a bootstrap file will no longer fail if some of the blocks already exist in the chainstate.

  • Bootstrapping can now be interrupted via Ctrl-C.

  • The speed of the import was improved.

• General

  • Fixed a bug that could lead to indefinite stalling of the node during initial sync when there are many peers and the host machine is slow.

[1.2.1] - 2026-02-28

Fixed

• Fixed a Windows-specific crash in node-daemon and node-gui that occurred when the chainstate DB reached 2 GB.

[1.2.0] - 2025-10-27

Changed

• A Mainnet fork is scheduled at height 517700 with the same consensus changes that previously happened on Testnet, namely:

  • Orders V1.
  • Change in the token id generation.
  • Transaction input commitments V1.
  • Prohibit updating staker's destination in ProduceBlockFromStake outputs.

  See the changelog for v1.1.0 below for extra details.

[1.1.0] - 2025-08-21

Added

• Wallet:

  • Added a new wallet-cli command to undiscourage a previously discouraged peer - node-undiscourage-peer-address.

  • Added a new wallet-cli command to return the account's extended public key - account-extended-public-key-as-hex.

  • Added new wallet-cli command config-broadcast. When config-broadcast no is called, it prevents all commands that create transactions from automatically broadcasting them to the network.

  • wallet-cli gained a new option --no-qr, which disables QR code output for wallet commands.

  • Added support for Trezor hardware wallets (beta).

    Because of this, wallet-cli and wallet-rpc-daemon gained an additional parameter, --hardware-wallet, which must be used together with --wallet-file to indicate that the wallet file being opened corresponds to a hardware wallet.

• Wallet RPC:

  • New methods: account_extended_public_key, node_undiscourage_peer_address (similar to the corresponding commands in wallet-cli) and token_make_tx_to_send_with_intent.

• Node RPC: new methods - chainstate_pool_decommission_destination, p2p_undiscourage.

• node-gui and node-daemon now can store info-level logs to the data directory, regardless of what is printed to the console. This is controlled by the --log-to-file option, which is enabled by default for node-gui.

Changed

• A Testnet fork is scheduled at height 566060 with the following consensus changes:

  • Orders V1. The previous (V0) order inputs will no longer be supported, and the new (V1) ones will have to be used instead.
    The main difference is that the new order commands don't use nonces. Also, an additional order-related input will be available - FreezeOrder.

  • Change in the token id generation.

    Previously, when a new token was being issued, its token id would be generated from the first input of the issuing transaction (which can be UTXO-based or account-based).
    Now the token id will always be generated from the first UTXO input of the issuing transaction.

  • Transaction input commitments V1.

    Transaction signatures will now commit to additional information about the transaction (i.e. the information will become a part of what is being signed), namely:

    • In transactions that decommission a pool the signatures will commit to the current staker balance.
    • In transactions that fill or conclude an order the signatures will commit to the order balances.

  • Updating staker's destination in ProduceBlockFromStake outputs will no longer be possible.

• ChainstateStorageVersion was increased, full node resync is required.

• Wallet CLI commands:

  • wallet-create was split into 2 commands - wallet-create and wallet-recover. They both create a new wallet file and the difference is that wallet-recover rescans the blockchain upon creation and wallet-create doesn't.

  • wallet-create/wallet-recover/wallet-open now have a mandatory subcommand, which can be either software or trezor, which specifies the type of the wallet to operate on.

  • staking-create-pool now accepts two optional additional parameters - the staker address and the VRF public key. This allows to create a pool from a wallet other than the one that will be used for staking.

  • transaction-list-by-address and transaction-list-pending now print their output in paginated mode.

  • address-show now has the option --include-change, which makes it include the change addresses in the output. The command will now also print the coin balances of shown addresses.

  • address-sweep-spendable now has the option --all, which makes it sweep all addresses of the selected account.

• Wallet RPC:

  • Most of the methods that create transactions, such as address_send, now accept an additional field in their options parameter - broadcast_to_mempool, which specifies whether the transaction should be sent to the mempool upon creation. The default is true (which is the old behavior).

  • Methods that create transactions now also return extra information in addition to the transaction id - the transaction itself (in the hex-encoded form), the info about fees paid by the transaction, whether it was broadcast to mempool or not.

  • address_sweep_spendable gained an additional boolean parameter - all, which may be used to force it to sweep all addresses from the given account.

  • staking_create_pool gained additional optional parameters - staker_address and vrf_public_key, same as the corresponding wallet-cli command.

  • wallet_create was split into wallet_create and wallet_recover, same as the corresponding wallet-cli command.

  • wallet_create, wallet_recover and wallet_open gained an additional optional parameter - hardware_wallet. This specifies the type of the hardware wallet to use (currently only trezor wallets are supported); if not set, the wallet is meant to be a software wallet.

    The results of wallet_create, wallet_recover and wallet_open now may contain additional data, to indicate a situation when creating/recovering/opening a hardware wallet could not be completed due to multiple potentially suitable devices being available.

    Also, wallet_create and wallet_recover's result will no longer include the passphrase.

  • wallet_info returns an additional field extra_info, which specifies whether it's a software or hardware wallet; in the latter case the field will also contain additional information, such as the device name.

  • address_show gained an additional parameter - include_change_addresses, similar to the corresponding command in wallet-cli.

    Also, the result of the call now contains additional info - the purpose of each address ("Receive" or "Change") and its coins balance.

• The format of `PartiallySignedTransaction was changed.

  Note that PartiallySignedTransaction is returned or accepted in the hex-encoded form by certain wallet-cli commands and their wallet RPC counterparts, such as transaction-compose or account-sign-raw-transaction.

Fixed

• Fixed issues in the wallet related to a transaction with an outdated nonce not being marked as conflicted.

• node-gui no longer ignores the network type (i.e. "mainnet" ot "testnet") passed via the command line.

• Fixed an issue where node-gui would appear stuck when opening a wallet that wasn't synced in a long time.

• Fixed an issue in the wallet where a text summary for a token-issuing transaction would show its "freezable" status incorrectly.

• Fixed issues with transaction fee calculation in the wallet.

• Fixes related to standalone private keys in the wallet:

  • Fixed encryption of standalone private keys when a new password is set or the existing one is changed.
  • Fixed watching/scanning for relevant public key destinations belonging to standalone private keys (only public key hash destinations used to work before).
  • Fixed wallet balance to show spendable UTXOs belonging to standalone private keys.

• Various minor visual fixes in node-gui.

• wallet-cli help output was prettified.

[1.0.2] - 2025-01-19

No changes except for the API server, see the corresponding CHANGELOG.md.

[1.0.1] - 2024-12-11

Fixed

• Fix erroneous peer discouragement after mempool reorg.

[1.0.0] - 2024-11-15

First major release.