Staking v6.2.3

Release Date: September 7, 2026 Tags: ON-CHAIN STAKING, SOLANA, ETHEREUM, CUSTODY, COMPLIANCE, VALIDATORS, SETTINGS, PERMISSIONS, DATABASE, MOBILE

Overview

An on-chain staking release, and the largest change this extension has had. The extension now sells one of two products, chosen by a Super Admin under Staking → Settings: the fixed-rate product it always sold, now described as what it is — a rate this platform sets and pays from its own wallet — or custodial on-chain staking, where a customer's coins are delegated on Solana or through Lido on Ethereum from a wallet this platform holds, and the reward is whatever the network paid, minus a commission the customer acknowledged before staking. Nothing switches by itself: an install that never opens the console keeps selling the fixed-rate product exactly as before.

Two things change for the fixed-rate product on the day you update, and both are in Upgrade Notes: it ships blocked for residents of the United States, the United Kingdom, the EU, Singapore and Hong Kong, and a new stake is refused when the Super Admin's wallet cannot cover what the live book already promises. The on-chain product is reachable only after two extensions are installed — Ecosystem, and the Web3 Wallet & On-Chain Trading addon, which this platform installs under the name dex and its own screens call Swap — and a chain has been activated through its wizard.

Requires Core v6.7.6; the on-chain product additionally requires the Ecosystem extension and the Web3 Wallet & On-Chain Trading addon. How an on-chain stake moves is the long form, and Operating on-chain staking is the runbook.

Update Instructions

pnpm updator

Update Core to 6.7.6 first: the six scheduled jobs that drive the on-chain product, the extension-menu gates, the twenty new permission keys and the translations are carried there. Both halves of this release matter — the guards, the settings module and the engine are server-side and need the backend restart; every staking screen, the admin consoles and the landing page live in the browser bundle and need the frontend rebuild.

• The update adds eleven tables and new columns to the pool, position and earnings tables, and it relaxes eight existing columns on the pool table — the fixed-rate terms an on-chain pool does not have. They apply themselves on the first boot that is allowed to sync the schema; an install that boots with DB_SYNC=none needs one such boot, and a fresh install imports the regenerated initial.sql. Do not skip this on an install that intends to run on-chain staking: without the relaxed columns an on-chain pool cannot be created at all, and the attempt fails on saving rather than on the form.
• Then open Staking → Settings. Nothing there has moved for you, but the fixed-rate territory gate and the treasury check below are already on.
• If you run the Ecosystem extension, update it to 6.5.0 in the same window and read If you run Ecosystem in Upgrade Notes below. You do not have to do anything with on-chain staking — it stays off until you turn it on — but the two extensions share the customer addresses and the key vault, and it is worth knowing that before you open a pool.

Highlights

Two products, one extension

Until now nothing in the code said which product a pool or a position was, and every staking setting was read in four places with four different rules for an absent key. The product is now a fact on the row: every pool and every position records the product it was opened under, fixed at creation, and the scheduled jobs, settlement and every exit door read the row rather than the global switch. The switch decides one thing only — which product accepts new stakes. A position opened under one product finishes under it however the switch is set later, so switching never strands anyone.

One module owns every staking setting, the extension's own settings screen validates each value, and the platform-wide settings endpoint refuses staking keys by name so nothing can write an invalid value around the validation. The switch itself is protected to Super Admin and refuses to move to on-chain while any requirement is missing — the Ecosystem extension installed, enabled and licensed, the Web3 Wallet & On-Chain Trading addon installed, enabled and licensed, the vault unlocked, a chain activated — naming the one that is.

The fixed-rate product, said plainly

A platform-set rate with nothing under it is the shape every regulator surveyed treats as a loan or a security, and the product's own copy used to describe it as staking with institutional-grade security, decentralised finance and no fees. The copy now says who pays the reward. The landing page, the pool page, the guide, the support assistant's answers and the navigation entries were rewritten, and the nine page-builder staking sections were withdrawn because each published a figure that editing could not make true.

Two controls go with the wording. The fixed-rate product ships blocked for residents of the US, the UK, the EU, Singapore and Hong Kong, on existing installs as well as fresh ones, under the same territory gate the Investment extension uses; a default territory can be unblocked only after a Super Admin accepts a versioned risk statement, and the gate sits on the stake door alone — exits are never blocked. And a fixed-rate reward is paid from the Super Admin's wallet, so a new stake is refused when that wallet cannot cover what the live book already promises plus the new stake, with the shortfall named in the pool's currency.

Custody, before a single coin moves

The on-chain product needs four records before a chain can take a customer's coins, and each is a screen. Chains is the activation wizard: the legal declaration — licence, regulator, jurisdictions served, commission and its notice period, the slashing policy, the ring-fence and no-guarantee acknowledgements, validator due diligence — accepted by a Super Admin by version, IP address and user agent. The territory rules are derived from it rather than typed: Singapore is blocked and cannot be unblocked, the UAE is refused, Hong Kong needs the SFC attestation and cannot use Lido, the UK and the US carry warnings, and an unlicensed operator is blocked from every territory the software knows needs a licence. Wallets holds one dedicated key per chain, sealed with the Ecosystem vault, decrypted in one place inside the signer and never shown; a frozen wallet still signs everything that gives a customer coins back and nothing else. Validators screens Solana validators live against a policy — at least eight, none in the superminority, inflation commission at most 5%, no more than 15% of a pool on one validator, at least two network operators — and re-screens every six hours. Batches and Incidents are the ledger of everything the engine signs and everything a person must look at.

Every transaction the staking key signs passes a firewall first: each instruction is decoded and checked against what that kind of batch may do, so a transaction that would hand control of a stake to another key — the shape that cost one custodian 192,600 SOL in 2025 — is refused by name before it is signed, and the approved intent is recorded and re-checked before broadcast.

Solana, and Ethereum through Lido

A stake moves the customer's own coins, with the customer's own key, from their deposit address to the staking wallet; is delegated across the validator set by weight; earns whatever the network pays, observed once per epoch and reflected in a share price; and exits in the order it was asked for, waiting the network's deactivation, before the settled amount is sent back to the customer's own address and credited only once it has landed. Every step is a batch the firewall approved, signed and recorded before it is broadcast, and never marked failed once it has reached the chain — it retries until it lands.

Ethereum goes through Lido: the coins are submitted for stETH held as shares, observed once per day, and exit through Lido's withdrawal queue in two steps before the claimable ETH comes back the same way. Lido's mainnet and Hoodi deployments are supported; its Sepolia deployment is deprecated and is not offered.

What the staker sees

An on-chain pool's page is its disclosure. The facts are generated from the pool's own records — where the coins are held, on which network, how many validators, the commission, how long activation and an exit take — the text is versioned by a hash of those facts, the quote shows the network fee and the timing for the amount typed, and five acknowledgements must be ticked before the stake button does anything. The stake is placed against the version the customer read; if the terms changed underneath them it is refused, and the page fetches the current ones with every tick cleared. There is no rate on the page, no lock, no early exit and no claim: rewards raise the share price and are paid on exit, and what the pool actually paid over the last 30 days is shown as an amount in the pool's own coin, labelled as history — never as a percentage, because a percentage beside a staking product reads as a promised rate. A monthly statement is written for every customer who held on-chain, downloadable from a new Statements page.

The companion mobile app was given the same vocabulary in its own repository — it parses the product, hides every rate and lock on an on-chain pool, and carries the disclosure, the quote, the acknowledgements and the unstake. That went all the way to the surfaces a customer meets first: the staking home, the pool cards and the dashboard tile, which until this release still promised a fixed term and a lock on an install selling neither. It also gains a statements screen — the same monthly summary the web page shows, without the download, because the list the app reads deliberately omits the file itself. All of it ships with the next app build.

The operator's doors

Commission is not booked as revenue when it accrues. It is minted as shares the platform holds in the pool, so it rises and falls with every customer's, and it becomes money only through an exit like any customer's: queued behind theirs, covered by the next exit batch, settled after every customer exit ahead of it, and paid to the chain's Ecosystem master wallet and nowhere else. A slashing incident can be reimbursed up to the cap the disclosure promised, pro rata to the holders, from the Super Admin's wallet, and is refused with the shortfall named when that wallet cannot fund it. A ten-minute alerts job raises what the hourly reconciler cannot see from the chain, and a Compliance console lists the activation records, every consent, every statement and the exports. Operating on-chain staking is the runbook for all of it, and ends with nine drills to run on a test network first.

What is deliberately not here

No periodic payout to the spot balance, no instant-exit buffer, no staking-as-a-service providers, no cold withdraw key. Each of those was decided against rather than deferred, and none is documented anywhere an operator can read it: a page describing features that do not exist reads as a roadmap the product owes you.

The liquid exit is the one that moved. It was on that list and is now built — an Ethereum exit can be released by selling the pool's stETH on the open market instead of waiting Lido's queue — and it ships switched off on every pool. It has never been run against any chain, and it is the subject of its own section in Upgrade Notes; read that before you turn it on.

Both live runs are done. The whole Solana cycle — delegate, deactivate, withdraw — ran against a local validator, and the Ethereum cycle including the claim ran against a fork of the real Lido contracts, driving the withdrawal queue's own finalisation rather than a stand-in for it.

Upgrade Notes

The fixed-rate product is blocked in five territories from this release

Residents of the United States, the United Kingdom, the twenty-seven EU member states, Singapore and Hong Kong are refused a new fixed-rate stake, on existing installs as well as fresh ones. Existing positions in those territories keep running, keep paying and can still be withdrawn: the gate is on the stake door only. If you serve customers there under a licence, review Staking → Settings → Compliance: a Super Admin can unblock a default territory after accepting the versioned risk statement, and the acceptance is recorded with the statement's version and the time.

• Changed the fixed-rate stake door to refuse a customer whose country is in the blocked list, naming the territory.
• Review the blocked list and the risk statement before your customers do.

A fixed-rate stake is refused when the treasury cannot cover it

A fixed-rate reward is paid from the Super Admin's wallet in the pool's currency. Until now nothing stopped a pool promising more than that wallet held: the payment engine capped the debit at the balance, booked the rest as unfunded, and credited the customer anyway. A new stake is now refused when that wallet cannot cover what every live fixed-rate position already promises plus the new one, and the refusal names the shortfall.

• Changed the fixed-rate stake door to check the Super Admin's wallet against the live book before accepting.
• Fund the Super Admin's wallet in each fixed-rate pool's currency for at least what the open positions will be paid, or the pool stops taking stakes.

Your validator sets will fail the policy until you record two facts

The Solana validator policy caps a validator's MEV commission and requires a set's members to sit in at least two distinct hosting networks. Neither fact can be read from the network, and until this release there was nowhere to enter them — so in practice no set had them, and both rules were written to run only where a value already existed. A set with neither recorded passed both. The verdict that resulted is what holds a Solana pool open to new stakes and lets a chain be activated, so it was being given on a policy graded in part on nothing.

Both rules now fail closed and name what is missing, and the two facts are entered on the validator set's edit screen, which is new in this release.

• Fixed two policy rules that skipped themselves rather than failing. A validator whose MEV commission has not been recorded, and a set that cannot show which hosting networks its members run in, are now breaches that name exactly what is missing.
• Open each Solana validator set and record every member's MEV commission and hosting network, with at least two members in different hosting networks.
• A set that read as healthy before this update will fail at its next six-hourly re-screen. While it fails, its pools refuse new stakes and a chain cannot be activated against it. Positions already open, claims, unbonding and exits are unaffected.

Switching the Staking addon off now warns you first

Disabling an extension in Admin → System → Extensions stops every scheduled job it owns, within a minute. For this addon that includes the job that claims unbonded coins and returns them to holders — and, in the same pass, the alert that would have told you exits had stopped. Nothing warned you, and nothing showed an error: the jobs simply disappeared from the cron console.

Switching it off while on-chain positions are still open now refuses once, says how many are outstanding and what stops, and points at the intake controls — which are the right lever for "take no new stakes", because they leave the settlement engine running.

• It is a warning, not a lock. Repeating the request with acknowledgeInFlight always goes through, however much is outstanding. That is deliberate: some on-chain states clear only when the network cooperates, so a stalled withdrawal or a dead validator must never be able to leave you unable to switch the addon off — and the switch is your last resort if the addon itself is the thing misbehaving.
• Enabling is never refused, and neither is switching off an addon that is already off.
• This does not fix the underlying behaviour, it only stops it being silent. If you acknowledge and switch off, exits really do stop until you switch back on.

A lapsed licence never traps a holder

On-chain staking now requires the Web3 Trading addon as well as Ecosystem, and that requirement is deliberately hard: without it the mode will not switch on, no on-chain pool can be created, and no new stake is accepted. It is equally deliberately one-directional. A commercial condition may stand between you and selling the product; it must never stand between a customer and coins they already own.

So everything that gets money back out is exempt, and stays working whatever your addons are doing:

• Exits. The unstake door has never consulted your addons, and the engines and scheduled jobs that deactivate a stake, claim it and return the coins do not either.
• The mobile app keeps the staking tab for anyone still holding a position, because it is the only screen in the app with an unstake button. Someone mid-unbonding would otherwise open the app to find the product gone while the route behind the missing button still worked. Someone with nothing staked does not see it, which is correct — the product cannot take their money.
• The operator's recovery levers. Re-sending a stuck transaction, paying a capped slashing reimbursement, running the reconciliation on demand and writing a period's statements were all gated on the full requirement list until this release, which meant a lapsed invoice could make a disclosed reimbursement unpayable — that door is the only one in the platform that pays it, and there is no scheduled equivalent. All four now require only that the product is the on-chain one.

The liquid exit is off, and must stay off until you have watched it

An Ethereum exit normally joins Lido's withdrawal queue and waits. This release adds a second route: selling the pool's stETH for ETH on a named market instead, which releases the holder in one transaction. It is switchable per pool with a maximum slippage you set, and when the price on offer is worse than that maximum the sale is refused and the exit takes the queue exactly as before.

It ships off on every pool, and it is the one path in the on-chain product that has never been run against a chain. It cannot be rehearsed, either: the test network the rest of the product is exercised on has no such market deployed, so there is nowhere to try it but production.

• Leave it off unless you have a reason to turn it on, and turn it on first for a pool holding a small amount you can afford to watch.
• It is set on the pool's own edit screen, on Ethereum pools only, together with the most an exit may lose against the protocol price.
• Switching it on regenerates that pool's disclosure, because it changes what an exit may cost, and everyone already in the pool is notified naming the cap you set. Switching it off is not notified: it can only return an exit to the protocol queue, which is what they agreed to. Operating on-chain staking carries the procedure.

Twenty new permission keys, granted to nobody until you grant them

The on-chain consoles — Chains, Wallets, Validators, Batches and Incidents — carry their own keys, seeded by Core 6.7.6, and the gates ship strict: until a role holds them, only a Super Admin can open those screens. The new Compliance console and the settings screen are gated the same way.

• Grant the staking.chain, staking.wallet, staking.validator, staking.batch, staking.incident and staking.settings keys under Admin → Users → Roles & Permissions → User Roles to the roles that run the extension.

Staking settings are written through the extension's own screen only

Every staking key is now validated by the extension's own settings endpoint, and the platform-wide settings endpoint refuses staking keys by name, pointing at Staking → Settings. An integration that wrote staking settings through the generic endpoint is refused with the key named.

• Changed the platform settings endpoint to refuse every staking key.
• Move any such integration to the extension's own settings endpoint.

The page-builder staking sections are gone

The nine staking sections the page builder offered each published a sample rate or a sample claim that no setting could make true — a live APY that "updates every epoch" over a rate an operator types, a total-value figure read "in real time from the staking contracts" where there is no contract, and a non-custodial promise on a custodial product. They are no longer offered. Pages already built from them keep working: a saved page carries its own sections and does not look them up again.

• Removed the nine staking section templates from the page builder's section picker.
• Check your landing pages for a staking section that quotes a rate you do not pay, and replace it with the extension's own landing page.

If you run Ecosystem

Nothing in this release changes what your Ecosystem customers see, and on-chain staking stays off until you turn it on. Two facts are worth knowing before you consider it, because they are shared between the two extensions.

The on-chain product does not hold customer coins of its own. It moves them from the customer's own Ecosystem deposit address, signed with that customer's own key, and returns them to the same address, where the deposit watcher credits them. So the Ecosystem key vault must be unlocked for a stake to be gathered. With it locked the stake is still accepted and the move retries. It used to retry for ever: the five-attempt rule that ends a stake and refunds it only ever applied when the customer's own address was short of coins, and a vault that would not open produced a different failure that was logged and tried again on the next pass, indefinitely, with the customer's balance already debited. From this release a move that has not reached the chain within twenty-four hours is given up on — the stake is marked failed with the reason, and the customer is refunded in full, because the coins never left their address. Nobody loses money to a locked vault, but a run of refunds with "the ecosystem key vault is locked" against them is what it looks like.

The custody rework in Ecosystem 6.5.0 changes the address model for addresses issued from then on and does not rewrite existing ones, so it does not disturb a stake in flight. If you intend to run both, settle the address model first and open the pool afterwards, so every staker is on the model you meant to keep.

• Update the Ecosystem extension to 6.5.0 alongside this release and work through its Custody migration guide.
• Keep the Ecosystem vault unlocked if you turn on-chain staking on.

Before you switch to on-chain staking

The switch refuses to move until each of these exists, so nothing here can be skipped by accident, but it is the list to work through, and Chains, wallets and validators is the page that walks each screen.

• Install, enable and license the Ecosystem extension and unlock its vault; the on-chain product uses its per-customer deposit addresses and keys.
• Install, enable and license the Web3 Trading addon, sold as Web3 Wallet & On-Chain Trading. On-chain staking refuses to switch on without it, including on an install that stakes only Solana and will never open a swap.
• Keep both addons licensed after you switch on. If either one is uninstalled, switched off or allowed to lapse, new stakes stop: the mobile app stops offering staking to anyone who does not already hold a position, and the on-chain doors refuse. Anyone who still holds coins on a chain keeps the staking tab and can still exit — see "A lapsed licence never traps a holder" below. The fixed-rate product is unaffected by either addon's state.
• Set the network the install uses for the chain — SOL_NETWORK or ETH_NETWORK — before the staking wallet is created, and set the matching RPC endpoints (ETH_MAINNET_RPC or ETH_HOODI_RPC for Lido). The wallet is created on that network and cannot be moved to another.
• Run the Chains wizard: create the staking wallet, fund its gas reserve, pick a validator set, declare the licence and the slashing policy, and accept the operator statement as a Super Admin.
• Create an Ecosystem master wallet for the chain if there is none; it is the only address the commission is ever paid to.
• Read the disclosure your customers will read before you open the pool. It is generated from what you declared.
• Work through the drills in Operating on-chain staking on a test network before the first customer stakes. There are nine, and they cover the kill switch, the wallet freeze, a forced exit, the commission, a slashing reimbursement and a restore from backup.

Added

The product switch and the settings module

• Added the stakingMode setting — fixed-rate or on-chain — with the product recorded on every pool and position at creation. The switch decides which product accepts new stakes and nothing else; absent or unreadable, it reads as fixed-rate.
• Added a staking settings endpoint that validates every key, refuses the on-chain product while a requirement is missing and names it, and protects the switch to Super Admin.
• Added a readiness panel on Staking → Settings that shows each requirement of the on-chain product and whether it is met.

The fixed-rate compliance tab

• Added a Compliance tab on Staking → Settings: the blocked territory list with its five defaults, the versioned risk statement, and the record of who accepted it and when.

Custody and compliance foundations of the on-chain product

• Added Chains, the activation wizard: one record per chain and network with the licence, the jurisdictions, the commission and its notice period, the slashing policy and cap, the acknowledgements and the operator statement accepted by version, IP and user agent. Pause, resume and retire from the same screen; pausing holds new stakes and nothing else.
• Added Wallets: one staking key per chain and network, sealed with the Ecosystem vault, never shown, with a gas reserve floor and a freeze that keeps exits, claims, returns, refunds and liquid exits signing — a freeze stops new money going out, never a holder getting theirs back. A new wallet now starts with the chain's own gas reserve floor already set; it used to start at zero, which reads as "no floor" and left the low-gas alarm switched off on every wallet until an operator happened to set one.
• Added Validators: screened Solana validator sets with the live policy verdict on every member, re-screened every six hours, and a candidate picker that only offers validators passing every rule the network itself can answer. The two facts the network does not publish — a validator's MEV commission and the hosting network it runs in — are recorded by you on the set's own edit screen, and the set does not pass the policy until they are there.
• Added Batches: every transaction the engine approved, signed and broadcast, with its decoded intent, its hash, its attempts and its state.
• Added Incidents: gas reserve, ledger drift, stuck batches, observer lag, validator breaches, slashing, overdue exits, stale delegations and unpaid commission — deduplicated while open, notifying every admin who holds the staking access permission, and never a reason an exit waits. A critical incident holds new stakes on its pool until it is resolved.
• Added Compliance: the activation records with the territory rules derived from each, every consent recorded at the stake door, every monthly statement, and CSV exports of consents, activations and observations.
• Added the transaction firewall in front of the staking key, the share ledger with its invariants, kill switches that gate the stake door only, and an hourly reconciler that compares the book with the chain.
• Added six scheduled jobs, carried by Core: batches every two minutes, the observer every fifteen, the reconciler hourly, validator screening every six hours, alerts every ten minutes, statements daily. Each is a no-op until a chain is activated.

The Solana engine

• Added on-chain staking of SOL: quote, stake with consent, delegation by validator weight into seeded stake accounts, a per-epoch observer that moves the share price and mints the commission as treasury shares on a positive reward only, first-in-first-out exits with split-and-deactivate, claims of inactive accounts, and a return to the customer's own address credited only after it lands. A negative residual against the chain opens a slashing incident and takes no commission.

Ethereum through Lido

• Added on-chain staking of ETH through Lido: submit for stETH held as shares, a daily observer, the two-step exit through the withdrawal queue in chunks the queue accepts, a claim only once every request is finalised, and the same return and credit. Lido's stake limit and pause defer a submit rather than fail it; bunker mode lengthens the exit estimate the quote shows. Mainnet and Hoodi are supported.

What the staker sees

• Added the on-chain pool page: the disclosure generated from the pool's records, the quote for the typed amount, the five acknowledgements, and a stake placed against the disclosure version the customer read.
• Added the on-chain position card: seven states from pending delegation to returned, the value now and the rewards to date, the date the coins are due back once an exit is requested, and an unstake — all of it or a number of shares.
• Added a Statements page and menu entry: one downloadable CSV per month the customer held on-chain — staked, exited, rewards net of commission, the commission, and the value at the time of writing — hashed when written and never regenerated.
• Added an On-chain pools section to the staking guide, and an on-chain paragraph to its risks.

The operator's doors

• Added the on-chain Overview: per wallet, the native balance, the gas floor and the book value delegated; per pool, the share state, the observer's lag, the validator verdict, the commission held and realised, the positions by state and the unbonding ladder with anything past the promised bound marked; open incidents; batches in flight.
• Added the on-chain pool form: an activated chain, the words, a minimum, an optional maximum and the commission, with the venue, wallet, validator set and slashing policy shown read-only from the activation. No rate, lock, capacity, early-exit fee, cadence or tiers.
• Added an On-chain tab on the pool page: the commission ledger with Observe now and Unstake commission, the stake accounts or Lido shares with their validator and observed value, and the observations that moved the share price.
• Added the commission ledger as the Earnings page in on-chain mode: per pool, what the treasury holds, what accrued at each observation, what was realised to the platform's own address, and the exit in progress.
• Added the commission exit: treasury shares queued behind the customers' exits, settled from the treasury after them, paid to the chain's Ecosystem master wallet only. One open request per pool; refused while the wallet is frozen or the chain has no master wallet.
• Added Reimburse… on a slashing incident: up to the cap the disclosure promised, pro rata by shares, from the Super Admin's wallet in the pool's currency, refused with the shortfall named when it cannot fund it. The incident records the amount and resolves itself when the cap is reached.
• Added the force-unstake door on an on-chain position, with a reason the holder is shown; it replaces approve and reject, which have no meaning there.

Documentation

• Added How an on-chain stake moves: one stake from quote to return, and which scheduled task drives each step.
• Added Chains, wallets and validators: the five screens behind the on-chain product, and the rule they share — nothing on them ever holds a customer's exit.
• Added Operating on-chain staking: the commission exit, the slashing reimbursement, the alerts, the statements, and nine drills to run on a test network before the first customer stakes.

Abandoning a stake that was gathered but never delegated

When a customer's coins have been gathered into the staking wallet but the delegation keeps reverting, the platform retried on its own schedule and an operator had no other move. The holder could not get out either — leaving a pool needs shares, and a stake that never delegated has none — so the coins sat in the staking wallet with no way back.

• Added an Abandon and return coins action on an on-chain position whose coins reached the staking wallet but were never delegated. It asks for a reason, which the holder is shown on their position and in the message they receive. Nothing is credited when you take the action: the position is marked to return exactly the amount that reached the staking wallet, the ordinary return run sends that amount to the holder's own deposit address, and it is credited only once the transfer has landed — the same rule every other exit follows. The position finishes as failed, because no stake ever happened. The action appears only on a stake still waiting to be delegated; one that already holds pool shares is refused with a note to unstake it instead.

The disclosure says where every kind of money goes

A disclosure that is silent about where a category of money goes is exactly the silence the document exists to remove. Two were unstated. Neither statement changes how the money is handled — only that the customer is now told.

• Added two statements to the disclosure every on-chain staker accepts before a stake is placed. On Solana it states that anything the network pays into the pool's stake accounts beyond the delegation reward — a validator's MEV tips, for instance — is added to the pool's value for holders in full, with no commission taken on it. On Ethereum it states that Lido's own fee is taken before anything reaches this platform, so the commission is charged on the net amount only.
• Added a panel on Staking → Settings for installs that do not have the Web3 Trading addon, saying what it is and what on-chain staking would let them do with it. It distinguishes the three states rather than treating them alike: not installed is an offer, installed-but-switched-off is a toggle they already own, and installed-but-unlicensed is a licence they have most likely already paid for and not activated. It disappears once the addon is installed, enabled and licensed.
• Added a Liquid exit panel to the on-chain pool's edit screen, on Ethereum pools only: the switch, the most an exit may lose in basis points, and a warning on the control itself that this route has never been run against a chain. It does not appear when creating a pool, because a new pool always starts with it off.
• Added a sentence at the top of every on-chain pool's timings saying whether an exit can be released early by selling on the open market. Off, which is how every pool ships, it reads that an exit always waits for the network's own process; on, it names the most an exit may lose against the protocol price. Because the text is generated from the pool's own record, its version moves with this release — a customer still holding the old text is shown the new one and asked to accept it before their stake goes through.

Changed

The fixed-rate product describes itself

• Changed the landing page, the pool browser, the pool page, the guide, the navigation entries and the support assistant's staking answers to say that a fixed-rate pool pays a rate this platform sets and funds. The claims of institutional-grade security, decentralised finance and no fees are gone.
• Changed twenty-six interface strings in English and propagated the rewritten sentences to all ninety language catalogues in English, so no catalogue keeps a translation of a sentence that no longer exists. New navigation entries were added to every catalogue the same way.
• Changed the navigation to carry one user entry per product, shown by the switch. The gate that makes those entries appear and disappear is in Core 6.7.6: extension menus had never run the extension, setting and condition gates the core menus always did.

The fixed-rate engine reads the row's product

• Changed the scheduled reward job, settlement, the withdraw, claim, approve, reject, complete, cancel, bulk and distribution doors to act on fixed-rate rows only; each refuses an on-chain row by name. A source-scan test holds the list.
• Changed the fixed-rate stake door to answer with the treasury shortfall, the blocked territory, or the product it will not open a stake under, rather than a generic refusal.

Rates are never stated for what has none

• Changed the platform statistics, the landing page's average, highest and lowest rate, its highest-rate and flexible pool lists and its per-token figures to count fixed-rate pools only. An on-chain pool's rate and lock columns are zero because it has neither, and were dragging every average down.
• Changed the pool card, the dashboard and the positions list to branch on the product, so an on-chain pool never renders "0% APR" or a lock it does not have; the positions tabs show an on-chain exit under Pending withdrawal and a refunded failure under Completed.
• Changed the featured-pool card on the landing page to say what the network pays and how long an exit takes for an on-chain pool, instead of a rate and a lock period.
• Changed the responses the mobile app reads to omit the on-chain observed rate as they already omit every fixed rate; the pool analytics and user earnings routes, which were never shaped for the app, now are.

The pool routes understand the product

• Changed pool creation to take the product from the switch and, for an on-chain pool, an activated chain: the wallet, the validator set, the slashing policy and the timing come from the activation, and every fixed-rate term is refused.
• Changed pool editing on an on-chain pool to accept the words, the limits, the status, the intake switch and the commission — a decrease at once, an increase pending until the activation's notice period has run, with every holder notified and the disclosure version bumped.
• Changed the position's end date to be empty on an on-chain position, which has no term; every fixed-rate reader of it now goes through one helper that stops rather than pricing an exit against an invalid date.

On-chain-only admin actions refuse on a fixed-rate install

These four actions exist only because a chain does: a transaction waiting to be signed by a staking key, a pass that compares what the chain holds against the book, the monthly record attesting to what a network paid a holder, and a reimbursement paid out of the operator's own treasury for a validator penalty. An install running the fixed-rate product has none of those things, and yet all four still answered — the retry said the transaction could not be found, the reconciliation returned a clean report on nothing, the statement run wrote no statements and called that a success. None could have moved money that way, but each read as an empty or broken console rather than as a product never switched on.

• Changed the four admin actions only an on-chain install has — making a stuck transaction due to be signed again, running the reconciliation pass on demand, writing a period's statements, and paying a capped slashing reimbursement — to refuse unless on-chain staking is switched on and every requirement behind it is met, naming the first requirement that is not.

Validators are screened on the blocks they miss

A validator can vote on time, charge no more commission than its neighbour, and still hand its delegators less, simply by failing to produce blocks in the slots it was given — those rewards are never paid to anyone. The screening had no way to see it, so such a validator kept its place and kept receiving new delegation.

• Changed the Solana validator policy to read each validator's block production and record a breach when it missed more than 30% of the leader slots it was assigned this epoch, once it was assigned at least twenty of them. A validator whose block production the network does not report at all is a breach as well, not a pass. A breaching validator takes no new delegation and its set stops passing the policy, which holds new stakes into every pool using that set; stake already delegated keeps running and exits are unaffected. Sets that passed before may show a breach at their next screening.

The app's staking home speaks the on-chain product's words

On an on-chain install the app's staking home still spoke for the fixed-rate product the platform is not selling. The subtitle promised a fixed term, the headline read "Total Value Locked" under a padlock, "Rewards Paid" sat over money this platform never paid, and the About dialog told the customer that the longer they stake the more they earn. None of that is true of coins delegated on a network at whatever the network decides to pay.

• Changed the staking home's wording on an on-chain install: the subtitle reads "Delegated on the network", the headline figure is "Total Staked" under a chain-link mark, the reward figure is "Rewards Recorded", the Stake Now card says "Delegate on-chain", and an empty My Stakes tab invites the customer to have a coin delegated on its network rather than to start earning. The About dialog now says the coins are delegated from a wallet the platform holds, that the reward is whatever the network pays minus the stated commission, that nothing is fixed or guaranteed, that there is no lock, and that an exit waits for the network. The screen asks the platform which product it is selling rather than guessing from the first pool to load, and holds the fixed-rate wording until the platform has answered. The fixed-rate wording is unchanged.
• Changed the middle figure on an on-chain pool card in the app — on the featured strip and in the full pool list — to the exit wait: how long the network takes to release the coins, or a dash until the chain has been read for the first time. It printed Lock Period over a dash before, naming a commitment the product never asks for and then failing to state one. The size figure beside it now reads Staked rather than TVL. A fixed-rate card still shows the lock period and TVL, unchanged.

Fixed

Three staking strings were machine-made labels, not sentences

Three strings on the staking guide and the pool page had been filled in with a title-cased rendering of their own key rather than a sentence, and shown to customers that way: "Apr Is Subject To Market Conditions", and — where the reward formula belongs — "Rewards Formula Staked Amount Apr 365" and "The Basic Formula Rewards Staked Apr 365".

• Fixed the three as sentences, in every catalogue; the two formula strings now state the formula.

The country gate listed a staking route that does not exist

The territory rules named /api/staking/withdraw as the staking exit. There is no such route — the exit is the position's own withdraw route — so that entry matched nothing and classified nothing. The route it was meant to name was already covered by the staking prefix beside it, so no exit was ever left unclassified.

• Fixed the rule list to drop the route that matched nothing.

A refresh spinner fired on every arrival of the admin pool page

The admin pool detail page turned its refresh spinner on and off around every load, including the first, which React flags as a cascading render.

• Fixed the first load to use the page's own pending state; the spinner belongs to the Refresh button and the retry.

An instant Solana exit charged the pool twice

When a Solana pool's undelegated surplus already covered every queued exit, the exit settled at once without touching the chain — and the pool's book was charged for it twice, once for the whole requirement up front and again as each holder was paid. The pool's liquid value then read lower than what the staking wallet actually held, so the exits that should have been paid on the spot stalled for want of money that was sitting there, and every exit behind them stalled with them. At the pool's next reading the missing value was taken for a loss on the chain: the platform wrote the pool's value down by that amount, lowering what every remaining holder's stake was worth, and raised a critical loss alarm against a pool that had lost nothing.

• Fixed the instant exit on a Solana staking pool being charged to the pool twice, which stalled the very exits it was meant to pay and then made the pool look as though it had lost that value on-chain. It now costs the pool once, as each holder is paid.

A stake whose coins never reached the staking wallet could wait for ever

• Fixed an on-chain stake that could sit at pending delegation for ever with the holder's balance already debited. Once the transfer of their coins into the staking wallet had a transaction recorded against it, it left the work queue for good: a transfer that reverted, or that expired without ever being seen, was neither sent again nor failed, and nothing anywhere could either finish the stake or give the money back. A transfer that could not be signed at all — a locked Ecosystem key vault, for instance — was retried every couple of minutes with nothing to end it. The platform now asks the network before it touches anything, sends the transfer again only once the old one is provably dead, and gives up on one that has not reached the chain within twenty-four hours: the stake is marked failed with the reason, the holder is told, and the principal is credited back in full. Both on-chain venues, Solana and Ethereum through Lido.

A single failed on-chain stake blocked the way back to the fixed-rate product

Switching the staking product back to fixed rate is refused while on-chain positions still hold coins on chain. Positions that had already failed were counted among them — a stake whose move into the staking wallet never landed and was refunded in full, and a stake an operator abandoned, whose coins went back to the holder before the position was closed. Both hold nothing. A failed position never changes status again, so one failed stake, ever, refused the switch for good — and the refusal told the operator to unstake those positions and wait for unbonding, which cannot be done: the unstake door answers that the position has already failed. The only way out was to delete the record of the failed stake.

• Fixed the count of on-chain positions still holding coins, both in the refusal that blocks switching the product back to fixed rate and in the figure shown beside that switch on the staking settings screen, which disagreed with the switch. The way back now opens once every position that actually holds coins has exited.

The app showed the platform staking totals as complete

The platform values both of its staking money figures in one currency and deliberately drops any pool token it holds no exchange rate for, naming what it dropped rather than valuing it at zero or at par. The app discarded that list and drew the shortened totals as the whole picture. On an install whose exchange listing has never synced, every pool token except USDT comes back unrated, so a platform staking coins of its own announced $0 staked and $0 in rewards beside a live stakers count, with nothing on the screen to explain it. A fixed-rate platform usually escaped this, because the peg stands in for USDT and fixed-rate pools are overwhelmingly USDT; an on-chain platform, denominated in whichever chains you switched on, does not.

• Fixed the app's platform staking figures to name the tokens left out and state that both money totals exclude them, so the headline reads as at-least-this-much rather than as fact. The figures themselves are unchanged, and the stakers count was never affected.

The overview page said this version left the on-chain engine out

• Fixed the Staking overview, which said this version shipped the product switch, the settings console and the per-position record of which product a stake belongs to but not the on-chain engine, and which still opened by saying the addon has no on-chain component at all. Both statements were written while they were true and stopped being true before the release was finished. An operator who read that page and went no further would never have tried to turn the product on, and the support agent, which answers from these pages, would have told anyone who asked the same thing. Both engines ship; the page now says so and says what turning the product on requires. Its inventory was stale in three places as well and is corrected: eleven admin screens rather than ten (Compliance was missing), six user screens rather than four (Statements and the landing page were missing), and seven scheduled tasks rather than five (the alerts job and the statements job were missing).

The staking guide's on-chain sections were English on every install

The guide is translated — every other sentence on the page is served from the catalogues in the reader's own language. The on-chain sections were added later and were left as hardcoded English, so a customer reading the guide in their own language reached the part explaining the product they were actually being sold and found it in a language they may not read. It is the section that says their coins move, that there is no lock, and that a network penalty lowers what their stake is worth.

• Fixed the guide's on-chain sections, which were the only untranslated prose left on the page, by putting all twenty-eight strings through the catalogues in the usual way — seeded in English into all 90 so every install renders a sentence rather than a key, and ready for translators. The paragraph listing what a position shows after you stake became a labelled list of the six states while it was converted, because a sentence with six emphasised names threaded through it cannot be translated into languages that order them differently.

The staking guide told on-chain stakers they could claim their rewards

• Fixed the rewards section of the customer-facing staking guide, which told every staker that rewards arrive on a schedule the operator picks, that auto-compounding can be switched on, and that they can claim into their wallet at any time. An on-chain position refuses a claim outright and tells the customer to unstake instead, so a customer holding one was reading an instruction the product will not carry out. The section now ends with an on-chain paragraph: the network pays what it pays, the platform reads what it paid and raises the value of every holder's shares as it arrives, there is nothing to claim, and taking only the rewards out means unstaking the part of the position they represent.

A Solana exit could not be filed while the network was unreachable

Requesting an on-chain exit reads nothing from the chain — the request freezes the share price, stops rewards and queues the work, all from records this platform already holds. The Solana path read the chain anyway, before writing anything, and used the answer for one thing: the rough "about N hours" in the notification telling the holder when to expect their coins.

So an unset network setting, or any Solana RPC outage, threw before the request was recorded, and a holder whose coins were already delegated could not even ASK to leave until the outage passed. Nothing was lost, but the one action a holder must always be able to take was the one that depended on somebody else's uptime.

• Fixed the on-chain exit request on Solana, which failed outright when the network could not be read. The request is now written from this platform's own records; the estimated timings are read only if the pool has not recorded them already, and when they cannot be read the notification says the exit waits for the network's unbonding period rather than quoting an invented figure.

Recovery actions were blocked by an addon licence

• Fixed four operator actions that refused when the Ecosystem or Web3 Trading licence had lapsed: making a stuck transaction due again, paying a capped slashing reimbursement, running the reconciliation pass on demand and writing a period's statements. None of them takes money in and every one is how money gets back to somebody — and the reimbursement door is the only thing in the platform that pays a slashing reimbursement at all, with no scheduled equivalent, so a licence that lapsed on the day a validator was penalised made a promise in the pool's own disclosure unpayable. All four now require only that the platform is selling the on-chain product.

Switching an addon off stopped the jobs that pay people, silently

• Fixed the extension switch, which performed no check of any kind before disabling an addon. Every scheduled job that addon owns stops within the minute, and for several addons those jobs are the only path returning customer money — for staking, the one that claims unbonded coins and returns them, deregistered alongside the alert that would have reported the stoppage. Disabling now reports what is outstanding and asks you to confirm.
• Applies to Staking and Ecosystem in this release. The same shape exists in several other addons — P2P escrow release, ICO contributor refunds, NFT bid escrow, matured Forex and AI investment payouts, merchant payouts — and those are deliberately left unwarned for now rather than given a count that might be wrong: a false warning on the switch you reach for in an incident is worse than no warning at all.