Dependency security update
Blend published@blend-money/core, @blend-money/fe, and @blend-money/node version 3.0.1.- Updated Axios to 1.18.0 and viem to 2.55.8 to address dependency security advisories.
- Integration examples now pin the frontend SDK with
viem@2.55.8. - This patch does not change the public SDK API introduced in 3.0.0.
Bundler-native gas pricing
SDK 3.0.0 now obtains UserOperation gas prices from the bundler configured for each chain.- Pimlico endpoints use Pimlico’s gas-price RPC method.
- Alchemy endpoints use Alchemy’s priority-fee and base-fee data.
- The removed Blend discovery method is no longer part of the SDK.
Per-chain paymaster registry
SDK 2.0.0 replaced the single paymaster URL configuration with a provider-tagged registry.- Build Pimlico entries with
getPimlicoPaymasterEndpoints. - Build Alchemy entries with
getAlchemyPaymasterEndpointsand a Gas Manager policy ID. - Spread provider entries into one registry. Later entries replace earlier entries for the same chain.
- Only the frontend SDK needs this registry.
yAudit review completed for AllowlistedSwapAdapter
Security review of theAllowlistedSwapAdapter contract by yAudit. Zero critical, high, medium, or low findings. 5 informational findings acknowledged, all related to the adapter’s zero-balance operating assumption.View audit reportSherlock audit completed for cross-chain adapters and withdraw flow
Collaborative security review by Sherlock (auditors: deth, montecristo) coveringAcrossXChainAdapter.sol, CCTPXChainAdapter.sol, OFTXChainAdapter.sol, XChainVaultAction.sol, UserWithdrawVaultAction.sol, UserWithdrawController.sol, and supporting libraries.- No critical or high-severity issues identified
- 1 medium finding resolved (drain-mode dust revert)
- 1 low/info finding resolved (expired fill deadline validation)
Two SDKs, two auth modes
Blend now supports both browser-based and server-side integrations.@blend-money/fereplaces@blend-money/sdkfor frontend apps. Uses publishable keys and SIWE wallet signing.@blend-money/nodeis a new server SDK for backends using Privy, Turnkey, or other embedded wallet providers. Uses API keys (sk_live_).- Both SDKs share lifecycle types and amount helpers from
@blend-money/core. Frontend quote objects and serverSessionResultobjects have different shapes. - API routes restructured:
/sdk/*becomes/extern/fe/*(frontend) and/extern/svr/{accountTypeId}/*(server). - New Credentials page for managing SIWE domains, signing key rotation, and API keys.
- JWT revocation: per-token sign-out via Redis blocklist, plus org-wide key rotation for security incidents.
SDK docs updated for publishable keys and SIWE
Integration docs now reflect the frontend-first SDK flow:BlendSdk runs in the app with a client-safe publishableKey, users authenticate with SIWE, and deposits and withdrawals use transaction-intent quote and execution sessions through the Blend /sdk backend.Sherlock audit completed for cross-chain infrastructure
Sherlock review of Blend’s latest cross-chain infrastructure updates coveringAcrossXChainAdapter.sol, CCTPXChainAdapter.sol, XChainVaultAction.sol, BlendSafeFactory.sol, MorphoVaultLib.sol, and PriceLib.sol.- No critical, high, or medium severity issues identified
- 3 low/info findings resolved
- 2 low/info findings acknowledged
Sherlock audit completed for Ostium integration
Collaborative security audit by Sherlock (auditors: eeyore, montecristo) covering Blend’s integration with the Ostium perpetual trading platform and Morpho Bundler3 compatibility enhancements.- No critical or high-risk vulnerabilities identified
- 2 medium severity issues resolved
- 17 low/info findings addressed
Sherlock security review for swap adapters
Review ofSwapAdapter.sol and PriceLib.sol with 2 low/info findings resolved, including a new sweepToken function for recovering intermediate tokens in multi-hop swaps.View audit reportRate limiting controls added to Strategy Manager
Cantina audit of rate limiting enhancements with no severity issues found. Improvements include explicit visibility identifiers, rate limit bypass prevention, and off-by-one error fixes.View audit reportMulti-hop swap support and gas optimizations
Cantina audit of swap adapter enhancements including multi-hop swap functionality,calldata optimization, and upper bound validation for slippage parameters.View audit reportZellic security assessment of swap adapters
Independent review by Zellic confirming no severity issues in temporal access control mechanisms and WhitelistedSwapAdapter configurations.View audit reportCross-chain infrastructure reviewed by Cantina
Audit ofAcrossXChainAdapter and SwapAdapter contracts with no critical/high/medium issues. Gas optimizations implemented for cross-chain execution.View audit report