This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
ReleasePort's take
Light signalThe redeem action now correctly routes through pUSD collateral adapters and reports accurate payout deltas.
Why it matters: Fixes zero‑share redemption handling (fact id 63108) and improves error reporting for relayer failures (id 63619), ensuring reliable token payouts.
Summary
AI summaryRedeem action now correctly routes through pUSD collateral adapters and reports accurate payout deltas.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Setup action grants approvals for new collateral adapters. Setup action grants approvals for new collateral adapters. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Medium |
Redeem action now correctly handles zero-share redemption and routes through pUSD collateral adapters. Redeem action now correctly handles zero-share redemption and routes through pUSD collateral adapters. Source: llm_adapter@2026-07-14 Confidence: low |
— |
| Bugfix | Medium |
Redeem routes through pUSD collateral adapters for accurate token handling. Redeem routes through pUSD collateral adapters for accurate token handling. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Low |
Relayer failure now triggers missing-approval hint. Relayer failure now triggers missing-approval hint. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Refactor | Low |
Success message reports actual payout delta, showing warnings for zero payouts. Success message reports actual payout delta, showing warnings for zero payouts. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
Full changelog
Fixes a real-money bug: action:"redeem" returned success + a tx hash while redeeming 0 shares (Polymarket data-api: REDEEM size=0).
Root cause (verified on-chain): V2-era CLOB token_ids are still keyed to USDC.e (standard) / the legacy NegRiskAdapter's wrapped collateral (neg-risk) — not pUSD. Redeeming via CTF.redeemPositions with pUSD collateral computes a positionId nobody holds, and the CTF does not revert on zero balance — it burns nothing, pays nothing, and the tx succeeds.
Fix: redeem now routes through Polymarket's canonical pUSD collateral adapters (contracts; Sourcify exact_match; identity constants verified on-chain): CtfCollateralAdapter 0xAdA100Db00Ca00073811820692005400218FcE1f (standard) and NegRiskCtfCollateralAdapter 0xadA2005600Dec949baf300f4C6120000bDB6eAab (neg-risk). They pull your outcome tokens, redeem through the right path, and pay the winnings back as pUSD.
⚠️ Existing wallets: run action:"setup" confirm:true once before your next redeem — it grants the two new adapter approvals (setup reads approvals on-chain every run and signs what's missing).
Hardening from the adversarial audit of the fix: success message reports the actual payout delta (a $0 payout with winning tokens held returns a loud ⚠️, not ✅); EOA path checks receipt.status; relayer failure text now triggers the missing-approval hint. 153 tests green.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About blockrunai/blockrun-mcp
Live data for AI agents — search, research, markets, crypto, X/Twitter. Pay-per-call via x402 micropayments.
Related context
Beta — feedback welcome: [email protected]