Changelog

A governance and API security release: Approval Groups bring multi-signature control to withdrawals, policies, and group membership, alongside Ed25519 client key pair authentication and API key expiration dates.

• Approval Groups

  A named set of workspace members plus a signature threshold now governs sensitive actions. Assign a group to a wallet so no withdrawal leaves it until enough members sign off, or to a policy so rule changes need sign-off before they apply.

  
• Approval-gated group management

  Creating a group, changing its membership, and changing a wallet's assigned group are each approval-gated, so no single person can grant themselves signing authority. Every workspace starts with a Default Approval Group that reviews the creation of other groups.

• Approval Group Requests

  A new review tab under Approval surfaces pending group requests with per-reviewer status and an optional comment on approve or reject.

• Client Key Pair authentication

  API keys can now authenticate with an Ed25519 client key pair, so the signing credential never has to be stored by Fystack. Generate the key pair locally, or hold it non-exportable in AWS KMS.

  
• API key expiration dates

  API keys can carry an expiration date, making credential rotation a routine step instead of manual cleanup.

A sign-up and sign-in hardening pass — mandatory email verification — alongside a rebuilt Withdrawal Center with live multi-signature approval tracking.

• Mandatory email verification

  Sign-in now requires a verified email address. The verification flow was hardened mid-rollout to close an email-enumeration gap where sign-in behavior could reveal whether an address was registered.

• Redesigned Withdrawal Center

  A rebuilt withdrawal list, detail, and step tracker replaces the legacy withdrawal tracker, with live status polling and clearer per-step progress for higher transaction volumes.

• Multi-signature approval tracking

  Withdrawal details now show live approval status per signer, and policy rules can automatically bypass manual approval for withdrawals that qualify.

• Wallet balances & overview API

  New endpoints expose aggregated wallet balance and overview data, and withdrawal responses now include wallet details and approval counts.

• Analytics permission scoping

  Analytics routes now sit behind a dedicated RBAC permission instead of being reachable by any authenticated role.

A ground-up rebuild of policy and access control: a new policy engine with signed, tamper-evident bundles, and a complete RBAC overhaul with granular permissions and self-service role management.

• Programmable Policy Engine v2

  A new policy engine evaluates withdrawal and contract-call actions against configurable rules, with conflict detection and a full rule-builder UI for defining conditions, wallet targeting, and approval-group bindings.

• Signed policy bundles

  Policy bundles and cache entries are now cryptographically signed and verified, so served or cached policy can be checked for tampering.

• Custom role management

  Admins can create, edit, and delete custom roles from a new role management UI, with a permission matrix that prevents granting access above one's own level.

• Granular permissions

  Coarse workspace-level permissions were split into per-module read/write permissions, the legacy implicit wallet-role system was removed in favor of explicit wallet assignments, and the `guest` role was retired in favor of `viewer`.

• Live policy reload

  RBAC and policy changes now sync and reload without a service restart.

Self-hosted license enforcement, real-time notifications over SSE, and the first wave of role-based access control ahead of June's full RBAC rollout.

• License key system

  Self-hosted deployments are now gated by a signed license key, verified against a public key, with a keygen CLI for issuing keys.

• Real-time notifications

  Notifications now stream to clients over Server-Sent Events instead of polling, for instant delivery of alerts and status updates.

• API key IP whitelisting

  API keys can now be restricted to a whitelist of client IP addresses, and updated after creation, reducing the blast radius of a leaked key.

• RBAC foundations

  Initial role-based access control: roles are assigned on workspace invitation, surfaced in workspace API responses, and recorded in a new audit trail for role changes.

• Canonical JSON signing fix

  Fixed JSON canonicalization to follow RFC 8785, addressing a pentest finding affecting anything hashed or signed against a canonical payload.

Two new ways to keep wallets funded — per-transaction gas sponsorship and threshold-based auto refill — plus a withdrawal tracker rebuilt for concurrent flows and per-field wallet permissions.

• Gas Sponsorship

  Workspaces can enable gas sponsorship per wallet so users no longer need to hold ETH, SOL, or TRX to transact. At withdrawal time, gas is funded just-in-time from the workspace gas tank — surfaced through a new `gas_sponsorship_enabled` flag, a `FUNDING_GAS` withdrawal status, and the `withdrawal.funding_gas` webhook.

• Auto Gas Refill

  A separate threshold-based top-up: Auto Gas Refill watches each wallet's native balance (ETH, TRX, SOL) and, when it drops below your configured threshold, transfers a fixed amount from a gas-station wallet to keep it funded. Prevents failed transactions and removes manual top-ups for ops teams across transfers, trading, and custody flows.

• Redesigned withdrawal tracker

  Supports multiple concurrent in-flight withdrawals on a single screen, with each withdrawal showing its own progress states including the new Funding Gas step.

• Per-field wallet settings permissions

  Admins can update non-sensitive fields like wallet name and gas sponsorship toggle, while signing threshold, disabled state, and auto-approval limit remain owner-only with clear blocked-field errors.

• Network-scoped wallets

  Wallet creation and listing are now network-aware, with a network selector in the create form and filters that honor the selected networks.

• Wallet lifecycle controls

  Owners can delete or disable wallets directly from the wallet table and remove individual assets, with a new wallet purpose dropdown in the create flow.

Phishing-resistant authentication, administrator control over workspace lifecycles, and friendlier APIs for integrators.

• Passkey-based 2FA

  Register multiple passkeys per account — platform biometrics or hardware security keys — coexisting with TOTP so users can migrate gradually.

• Workspace rename & delete

  Administrators can rename or permanently delete workspaces directly from settings, with guardrails and instant UI propagation.

• Human-readable asset identifiers

  APIs now accept intuitive identifiers like `USDC` or `USDT` via a new asset resolver, replacing internal asset IDs.

• Auto-accept workspace invitations

  Pending invitations tied to a signing-in user are accepted automatically on first login, removing a redundant approval step.

• Cross-tab session coordination

  A new session hook detects workspace mismatches across browser tabs, preventing accidental operations on the wrong workspace.

Six major additions focused on compliance, cost optimization, and operational control across the transaction lifecycle.

• KYT integration with Scorechain

  Know-Your-Transaction screening scores deposits and withdrawals, feeding risk directly into approval workflows.

• Tron resource savings

  Reduced energy and bandwidth consumption during sweeps and withdrawals on the TRON network without impacting reliability.

• Role-based alert & webhook policies

  Alerts and webhooks now recognize Signer and Proposer roles, enabling role-scoped delivery and team-specific notifications.

• Cancel transaction API

  A new endpoint lets authorized users abandon unconfirmed transactions and automatically releases any holds placed at creation.

• Solana rent recovery & gas station

  Empty SPL token accounts are closed after sweeps, recycling rent SOL to fund future transaction fees via a dedicated gas station.

• Webhook CIDR allowlist

  Workspace admins can restrict outbound webhook destinations to specific CIDR ranges, validated on create and update.

Bitcoin joins as a first-class asset, safer write operations through idempotency, and a full rebuild of the withdrawal approval flow.

• Native Bitcoin support

  Dedicated Bitcoin RPC handler in the sweeper, UTXO multi-input MPC signing, HD wallet generation, and RBF tracking for in-flight transactions.

• Idempotency keys

  A Redis-backed middleware guards critical write operations, preventing duplicate withdrawals from client timeouts and enabling safe retries.

• Withdrawal approvals redesign

  New approval UI with clearer status, richer response types with timestamps, and the ability for proposers to cancel their own requests.

• Alerts module

  The legacy Notifications module was refactored into a standalone Alerts module with dedicated routing and navigation.

• Editable workspace names & token refresh

  Workspaces can be renamed from settings, 2FA modals auto-verify, and a new Token Refresh Manager improves session resilience.

Stronger separation of duties, financial visibility across wallets, and hierarchical deterministic keys inside the MPC cluster.

• Proposer role

  A new permission tier lets operations teams submit withdrawal proposals without approval authority, enforcing separation of duties.

• Withdrawal categories

  Tag withdrawals with custom labels like Operational, Payroll, or Refunds. Filter by category and include tags in CSV exports.

• Expense analytics dashboard

  Real-time spending metrics with volume, count, averages, donut and bar charts, monthly trends, and a ranked transaction list.

• Balance query by asset symbol

  `GET /workspaces/{id}/balances?symbol=USDC` returns consolidated holdings across every supported network for easier reconciliation.

• Child key derivation in MPCIUM

  BIP32-style ECDSA and extended EdDSA derivation bring HD wallet structures to the distributed MPC cluster without centralizing trust.

Security and integrity improvements across wallet operations, new Telegram-powered alerts, and major upgrades to the multichain indexer and MPC cluster.

• Security hardening

  CSRF defenses, authentication and encryption improvements, stronger session management, and expanded brute-force mitigations.

• Telegram alerts

  A new alert feature delivers webhook logging, resend functionality, and statistical APIs — integrated directly with Telegram.

• Responsive UI & wallet sorting

  Responsive design improvements, withdrawal detail visibility in approvals, and the ability to sort wallets by account balance.

• Database-backed balances

  Balance storage moved from Consul to the database, with SLSA provenance attestations added to Docker builds for supply-chain trust.

• Indexer & MPCIUM upgrades

  Multichain Indexer v1.0.10 standardizes cross-chain compatibility. MPCIUM v0.3.3 ships Kubernetes support and fixes a distributed ECDH race.

TRON blockchain joins the platform, distributed deployments gain leader election, and a new secret store enables AWS KMS signing.

• TRON blockchain support

  Full TRON integration with signing, transaction handling, address validation, and MPC wallet address updates.

• High availability

  Leader election for distributed deployments, split scheduler and block scanner, graceful shutdown, and rescanner distributed mode.

• Secret store & AWS KMS signer

  Pluggable secret store supporting AWS, plus an AWS KMS signer integration for stronger key protection in production.

• Role-based access control

  RBAC on wallet assignments, network and asset management restricted to system admins, address risk checker, and TLS configuration.

• NATS JetStream messaging

  Queues migrated for stats, signing events, and pubsub consumers. Legacy pubsub is deprecated and JetStream is now mandatory.

• Distroless Docker images

  Multi-architecture distroless images, updated Redis and Consul configurations, and refactored MPC signing with longer timeouts.

Wallet-level auto-approval limits, a worker pool architecture for webhook processing, and new workspace administration endpoints.

• Auto-approval thresholds

  New wallet settings store per-wallet automatic approval thresholds, with expanded filtering and API coverage for withdrawals.

• Webhook worker pools

  A worker pool architecture boosts webhook throughput and scalability — no extra configuration needed to activate.

• Resend invitation API

  A new endpoint and service implementation let admins resend workspace invitations that haven't been accepted.

• Expanded wallet search

  Wallet APIs now support user and asset search, plus supplementary data in network response payloads.

A foundational release introducing programmatic withdrawals, sweep automation, service accounts, and a full policy approval workflow.

• Withdrawal APIs

  Endpoints for fetching withdrawals by ID and requesting new withdrawals, with webhook callbacks for deposit and withdrawal events.

• Sweeper automation

  Sweep automation wired into the address book, deduplication and retry for MPC signing, and experimental MPC sweeper integration.

• Service accounts

  Create, update, and delete endpoints for managing service accounts used by automated integrations.

• Policy workflows

  Complete policy creation, approval, and rejection flow with validation rules and an experimental approval workflow.

• Monad network & price monitoring

  Monad network configuration support, prefix matching for asset search, and CoinMarketCap price monitoring integration.