Ecosystem v6.2.6

Release Date: June 30, 2026 Tags: CRITICAL FIXES, MONEY-SAFETY, UTXO WITHDRAWALS, ORDER MATCHING, ORDER BOOK, IDOR

Overview

Version 6.2.6 is the ecosystem-extension half of the platform-wide Core v6.4.9 security and money-safety audit. It hardens the custodial on-chain wallet and the order book where funds move: UTXO (Bitcoin-like) withdrawals can no longer double-spend if the process crashes mid-broadcast, the order book (CLOB) now matches and cancels correctly without ever minting balance, and internal transfers and deposit crediting are race- and double-processing-safe.

Requires Core v6.4.9.

---

Upgrade Notes

Compatibility

Requires Core v6.4.9 or higher. The database migrations for this release (including ecosystem schema changes) are applied by the core updator / migration commands — see the Core v6.4.9 patch notes for the one-time update steps. No ecosystem-only migration is required.

Breaking Changes

None — all changes are internal correctness and safety fixes; mainnet and existing-order behavior are preserved.

---

Fixed

Bitcoin-like withdrawals can't double-spend on a crash

UTXO-chain withdrawals previously broadcast the transaction on-chain before committing the database reservation — a crash in that window left the coins gone but the inputs still marked spendable (re-selectable into a second withdrawal) and the ledger un-decremented. The flow now reserves first: it persists the broadcast hash and moves the selected inputs to a new locked state inside the committed transaction, then broadcasts; on restart it resumes verification of in-flight withdrawals instead of re-broadcasting. Each locked input is tagged with the withdrawal that reserved it, so promoting an input from locked to spent is scoped to a single withdrawal and concurrent same-wallet withdrawals can never release each other's coins.

Orders, transfers, and deposits

Internal ECO transfers now check available balance — the balance less anything already held against open orders — so order-locked funds can't be moved, inside a single locked transaction with a stable idempotency key. Market-buy orders hold a worst-case, rounded-up cost computed by walking the order book, so deep fills can't strand funds on hold. The order-book reconciliation top-up uses a distinct key namespace (it no longer collides with the original placement hold and wrongly cancels orders). The deposit scanner calls its handler once per transaction (it previously processed each twice), the per-chain credit takes a row lock, the Bitcoin deposit scanner treats any existing deposit record for a transaction id as already handled (closing a double-credit window), and reverse address lookup on the withdrawal hot path is now an indexed lookup instead of a full-table scan. Ecosystem money and wallet-login endpoints now carry rate limits.

Order matching and cancellation are correct and mint-safe

The ecosystem order book (CLOB) had several order-lifecycle bugs that could hide orders from matching, refund the wrong asset, or create funds out of nothing. Order side and type are now normalized on write (and defensively on cancel): the matching engine compares them case-sensitively, so orders submitted in lower case (as the Pro trade panel did) no longer stay invisible to matching, and a cancel on a buy order is no longer handled as a sell — refunding the wrong currency and leaving the locked quote currency stranded on hold. The matching engine now serializes its work — concurrent place/cancel calls coalesce into a single ordered cycle with per-symbol sequential settlement and locks that are always released — instead of racing on shared state and getting stuck until a restart. Cancellation now atomically claims the order out of the engine (so an in-flight fill can't touch it) and refunds release-only: a cancel can only return funds already held against the order and never credits a surplus, so a stale order snapshot or an unfunded ghost order can no longer mint balance. Separately, the Core v6.4.9 wallet audit log no longer references the wallet record it describes, which had let an audit write on a second connection deadlock against the wallet lock held by the very place, cancel or fill it was recording — a contention that previously made every order operation take tens of seconds.

Deposit-address unlock and privileged routes

The ecosystem deposit-address unlock endpoint (which frees a reserved custodial address) now requires the lock holder or an admin. The destructive "migrate ECO transactions" maintenance route is now permission-gated, and setting the KMS master passphrase requires a dedicated high-privilege permission.