Release Notes

v1.4.0 (2026-02-09)

This release introduces enhanced security measures for message signing, updates timestamp handling, and simplifies transfer operations.

What Changed

Security Enhancements:

• All signed messages now require explicit action field (e.g., PLACE_ORDER, CANCEL_ORDER, CANCEL_ALL_ORDERS, TRANSFER, WITHDRAW)

• Message signing now uses canonicalized JSON with sorted keys for consistency

• Replay protection enforced with 5-minute window using Redis

• Timestamp validation: requests rejected if timestamp is in the future or older than 5 minutes

Timestamp Requirements:

• All timestamp fields must be integers in milliseconds (not ISO strings)

• Required timestamp field in request body or query params. This Applies to:
  

  • POST /orders (request body)

  • DELETE /orders/:id (query params)

  • DELETE /users/me/cancel-all-orders (query params)

  • PUT /transfers (request body)

  • POST /withdrawals (request body)

Transfer Changes:

• PUT /transfers: amount field now expects formatted values (e.g., "100.5" for ETH) instead of base units

• PUT /transfers: to_wallet_address is now required (username transfers removed)

Order Cancellation:

• DELETE /orders/:id now expects order_id, timestamp, and signature as query parameters

Migration Notes

• Update all message signing to include explicit action field in payload

• Change timestamp format from ISO strings to integer milliseconds: Date.now()

• Update transfer amount from base units (wei) to formatted decimals

• Remove username support from transfers, use wallet addresses only

v1.3.0 (2026-01-19)

This release standardizes API field names to snake_case

across all requests and responses, and updates the withdrawals claim response with clearer naming plus a new formatted amount field.

What Changed

• API key fields now use api_key and api_secret (previously camelCase)

• User fields now use wallet_address (previously walletAddress)

• Timestamps now use created_at and updated_at (previously createdAt and updatedAt)

• Pagination query parameters now use page_size (previously pageSize)

• Withdrawals claim response fields now use snake_case

• Added new amount_formatted field to withdrawals claim response

Updated Withdrawals Claim Response

New Format (v1.3.0):

{
  "status": "CLAIM_READY",
  "proof_ready": true,
  "local_exit_proof": "0x...",
  "global_exit_proof": "0x...",
  "global_claim_index": "42",
  "token_address": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
  "chain_id": 1,
  "destination_network_id": 2,
  "destination_address": "0x...",
  "amount": "100000000",
  "amount_formatted": "100.0",
  "bridge_contract_address": "0x..."
}

Migration Notes

• Update all camelCase fields to snake_case equivalents (e.g., pageSize → page_size, walletAddress → wallet_address)

• Update pagination query parameters from pageSize to page_size

• Handle the new amount_formatted field in withdrawals claim responses.