> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blend.money/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Protocol updates, new chain deployments, audit completions, SDK releases, and strategy changes.

Stay up to date with everything happening in the Blend ecosystem. Subscribe via RSS for automatic updates.

See [Audits](/resources/audits) for full audit reports and [Deployments](/resources/deployments) for current contract addresses.

<Update label="SDK 3.0.1" description="July 23, 2026" tags={["SDK", "Security", "Integration"]}>
  ## Dependency security update

  Blend published `@blend-money/core`, `@blend-money/fe`, and `@blend-money/node` version 3.0.1.

  * Updated Axios to 1.18.0 and viem to 2.55.8 to address dependency security advisories.
  * Integration examples now pin the frontend SDK with `viem@2.55.8`.
  * This patch does not change the public SDK API introduced in 3.0.0.
</Update>

<Update label="SDK 3.0.0" description="July 23, 2026" tags={["SDK", "Integration"]}>
  ## Bundler-native gas pricing

  SDK 3.0.0 now obtains UserOperation gas prices from the bundler configured for each chain.

  * Pimlico endpoints use Pimlico's gas-price RPC method.
  * Alchemy endpoints use Alchemy's priority-fee and base-fee data.
  * The removed Blend discovery method is no longer part of the SDK.
</Update>

<Update label="SDK 2.0.0" description="July 13, 2026" tags={["SDK", "Integration"]}>
  ## Per-chain paymaster registry

  SDK 2.0.0 replaced the single paymaster URL configuration with a provider-tagged registry.

  * Build Pimlico entries with `getPimlicoPaymasterEndpoints`.
  * Build Alchemy entries with `getAlchemyPaymasterEndpoints` and a Gas Manager policy ID.
  * Spread provider entries into one registry. Later entries replace earlier entries for the same chain.
  * Only the frontend SDK needs this registry.
</Update>

<Update label="AllowlistedSwapAdapter Audit" description="June 26, 2026" tags={["Security"]}>
  ## yAudit review completed for AllowlistedSwapAdapter

  Security review of the `AllowlistedSwapAdapter` contract by yAudit. Zero critical, high, medium, or low findings. 5 informational findings acknowledged, all related to the adapter's zero-balance operating assumption.

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-26-06-26-0-yaudit.pdf)
</Update>

<Update label="Cross-Chain Adapters & Withdraw Audit" description="June 12, 2026" tags={["Security", "Protocol", "Chain"]}>
  ## Sherlock audit completed for cross-chain adapters and withdraw flow

  Collaborative security review by Sherlock (auditors: deth, montecristo) covering `AcrossXChainAdapter.sol`, `CCTPXChainAdapter.sol`, `OFTXChainAdapter.sol`, `XChainVaultAction.sol`, `UserWithdrawVaultAction.sol`, `UserWithdrawController.sol`, and supporting libraries.

  * No critical or high-severity issues identified
  * 1 medium finding resolved (drain-mode dust revert)
  * 1 low/info finding resolved (expired fill deadline validation)

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-26-06-12-0.sherlock.pdf)
</Update>

<Update label="Dual SDK: Frontend and Server" description="May 6, 2026" tags={["SDK", "API", "Integration"]}>
  ## Two SDKs, two auth modes

  Blend now supports both browser-based and server-side integrations.

  * **`@blend-money/fe`** replaces `@blend-money/sdk` for frontend apps. Uses publishable keys and SIWE wallet signing.
  * **`@blend-money/node`** is a new server SDK for backends using Privy, Turnkey, or other embedded wallet providers. Uses API keys (`sk_live_`).
  * Both SDKs share lifecycle types and amount helpers from `@blend-money/core`. Frontend quote objects and server `SessionResult` objects have different shapes.
  * API routes restructured: `/sdk/*` becomes `/extern/fe/*` (frontend) and `/extern/svr/{accountTypeId}/*` (server).
  * New [Credentials](/build/configure-credentials) page for managing SIWE domains, signing key rotation, and API keys.
  * JWT revocation: per-token sign-out via Redis blocklist, plus org-wide key rotation for security incidents.

  See [API overview](/build/api/overview) for how the two authentication modes work.
</Update>

<Update label="Frontend SDK and Intent Sessions" description="May 4, 2026" tags={["SDK", "API", "Integration"]}>
  ## SDK docs updated for publishable keys and SIWE

  Integration docs now reflect the frontend-first SDK flow: `BlendSdk` runs in the app with a client-safe `publishableKey`, users authenticate with SIWE, and deposits and withdrawals use transaction-intent quote and execution sessions through the Blend `/sdk` backend.
</Update>

<Update label="Cross-Chain Infrastructure Audit" description="March 10, 2026" tags={["Security", "Chain", "Protocol"]}>
  ## Sherlock audit completed for cross-chain infrastructure

  Sherlock review of Blend's latest cross-chain infrastructure updates covering `AcrossXChainAdapter.sol`, `CCTPXChainAdapter.sol`, `XChainVaultAction.sol`, `BlendSafeFactory.sol`, `MorphoVaultLib.sol`, and `PriceLib.sol`.

  * No critical, high, or medium severity issues identified
  * 3 low/info findings resolved
  * 2 low/info findings acknowledged

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-26-03-10-0.sherlock.pdf)
</Update>

<Update label="Ostium Integration & Bundler3 Audit" description="January 22, 2026" tags={["Security", "Protocol"]}>
  ## Sherlock audit completed for Ostium integration

  Collaborative security audit by Sherlock (auditors: eeyore, montecristo) covering Blend's integration with the Ostium perpetual trading platform and Morpho Bundler3 compatibility enhancements.

  * No critical or high-risk vulnerabilities identified
  * 2 medium severity issues resolved
  * 17 low/info findings addressed

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-26-01-22-0-sherlock.pdf)
</Update>

<Update label="Swap Adapter Security Review" description="November 28, 2025" tags={["Security"]}>
  ## Sherlock security review for swap adapters

  Review of `SwapAdapter.sol` and `PriceLib.sol` with 2 low/info findings resolved, including a new `sweepToken` function for recovering intermediate tokens in multi-hop swaps.

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-25-12-05-0-sherlock.pdf)
</Update>

<Update label="Rate Limiting Enhancement" description="October 10, 2025" tags={["Security", "Protocol"]}>
  ## Rate limiting controls added to Strategy Manager

  Cantina audit of rate limiting enhancements with no severity issues found. Improvements include explicit visibility identifiers, rate limit bypass prevention, and off-by-one error fixes.

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-25-10-10-0-cantinacode.pdf)
</Update>

<Update label="Swap Adapter Enhancement" description="October 5, 2025" tags={["Security", "Protocol"]}>
  ## Multi-hop swap support and gas optimizations

  Cantina audit of swap adapter enhancements including multi-hop swap functionality, `calldata` optimization, and upper bound validation for slippage parameters.

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-25-10-05-0-cantinacode.pdf)
</Update>

<Update label="Zellic Swap Assessment" description="October 2, 2025" tags={["Security"]}>
  ## Zellic security assessment of swap adapters

  Independent review by Zellic confirming no severity issues in temporal access control mechanisms and WhitelistedSwapAdapter configurations.

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-25-10-02-0-zellic.pdf)
</Update>

<Update label="Cross-Chain Adapter Audit" description="September 29, 2025" tags={["Security", "Chain"]}>
  ## Cross-chain infrastructure reviewed by Cantina

  Audit of `AcrossXChainAdapter` and `SwapAdapter` contracts with no critical/high/medium issues. Gas optimizations implemented for cross-chain execution.

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-25-09-29-1-cantinacode.pdf)
</Update>

<Update label="Code Improvements Audit" description="September 29, 2025" tags={["Security", "Protocol"]}>
  ## Intent Engine improvements reviewed by Cantina

  Focused review of Intent Engine contract improvements with zero severity issues. Optimizations include loop restructuring and cached native token calls.

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-25-09-29-0-cantinacode.pdf)
</Update>

<Update label="Initial Protocol Audit" description="August 10, 2025" tags={["Security", "Protocol"]}>
  ## Cantina security review

  Blend's inaugural security audit by Cantina. No critical or high-risk vulnerabilities identified. Mature, well-maintained codebase with all medium-risk issues promptly fixed.

  [View audit report](https://github.com/BlendMoney/audits/blob/main/blend-25-08-10-0-cantinacode.pdf)
</Update>

<Update label="Multi-Chain Deployment" description="August 2025" tags={["Chain", "Protocol"]}>
  ## Blend deploys across 7 chains

  Contract deployments completed across Base, Ethereum, Arbitrum, Polygon, Scroll, HyperEVM, and Botanix. See [Deployments](/resources/deployments) for addresses.
</Update>