Security Updates

Important security and wallet-safety updates are listed here so users can review what changed and why it matters.

2026-03-12

Wallet Safety Hardening Rollout

Added stronger wallet safeguards around signing flow, transaction policy checks, and safer signed-request validation.

Impact: Improves resistance against phishing prompts and replay attempts.

User action: No action required if you are using the official domain.

Emergency wallet action kill switch in UI and transaction path.
Transaction policy checks for allowed programs and instruction limits.
Stricter signed message context validation (domain, URI, chain, nonce, time window).
Replay protection with nonce consumption and trusted-origin checks.

2026-03-13

Wallet Signing Policy Expansion

Expanded transaction filtering with instruction shape limits and semantic SPL token checks before wallet signing.

Impact: Reduces chance of hidden high-risk instructions being bundled into a prompt.

User action: Review wallet prompts as usual; protections now block more risky payloads automatically.

Added max accounts-per-instruction and instruction data-size thresholds.
Added semantic SPL token opcode restrictions per flow.
Applied stricter checks to token creation, standard pool, and CLMM-related flows.
Revalidated with focused security tests and lint checks.

Update Entry Template

Use this format for future security-related release notes.

Date: YYYY-MM-DD
Title: <short release title>
Summary: <1-2 line explanation>
Impact: <what risk or behavior changed>
User action: <what users should do, if anything>
Details:
- <key change 1>
- <key change 2>

Security Page Guide