Technical updates and release notes
Track Contracts, SDK, reference implementation, and operational helper updates at a level useful for RWA implementation planning.
Category
Released authenticated Wallet Link in Kit 0.7.0 and React 0.5.0
Applications can verify extension or PWA wallet links with short-lived proofs bound to an origin, purpose, and nonce, then safely restore the signed link session.
Impact
Voting, holdings, rewards, and membership applications can share one secure linking flow without trusting an address string or a local-storage flag as identity proof.
Changes
- Added challenge, approve, verify, session-verify APIs and browser bridges to @hazbase/kit 0.7.0
- Restricted PWA return URLs to the challenge origin and retained proofs after transient verification failures
- Added extension-first useWalletLink with optional PWA fallback to @hazbase/react 0.5.0
- Kept raw-address helpers for display and migration while deprecating them for identity-sensitive use
@hazbase/auth 0.6.1 adds refreshable sessions and purpose-bound step-up
Applications can now refresh email-OTP sessions and request additional email-link or passkey assurance scoped to a specific purpose and origin.
Impact
Applications can keep sign-in accessible on devices without passkeys while requiring stronger assurance only for sensitive actions such as voting, transfers, or permission changes.
Changes
- Refresh short-lived access tokens from a refresh token with refreshEmailSession
- Bind email-link completion to the initiating browser with createStepUpBrowserBinding
- Issue purpose- and origin-scoped assurance tokens from either email links or passkeys
- Verify the required assurance immediately before a sensitive action with verifyStepUpAssurance
Released SDK helpers for wallet linking and x402 integrations
@hazbase/auth 0.6.0, @hazbase/kit 0.6.0, and @hazbase/react 0.4.0 add generic passkey bridge, wallet-address linking, wallet API, and x402 handoff helpers.
Impact
Applications can integrate hazBase Wallet-compatible address linking, balance/activity reads, and x402 payment handoff without depending on a project-specific token or wallet implementation.
Changes
- Added extension passkey bridge controller helpers to @hazbase/auth
- Added createHazbaseWalletClient, wallet address bridge, and x402 browser handoff helpers to @hazbase/kit
- Added useWalletAddressLink, useHazbaseWalletClient, useTokenBalance, and useWalletActivity to @hazbase/react
- Standardized default API endpoint behavior around https://api.hazbase.com when no endpoint is supplied
Added a compliant-market reference flow
A reference flow now shows how to wire Whitelist, MarketManager, ReservePool, and EmergencyPauseManager for an RWA market.
Impact
Builders can review KYC-gated trading, emergency pause, and governance recovery responsibilities before implementation.
Changes
- Organized recommended deployment order across Token, Whitelist, ReservePool, and MarketManager
- Separated Guardian, Timelock, Governor, and Compliance Ops responsibilities
- Linked to minimal code examples for emergency pause and recovery flows
Organized SDK helpers for distribution and reserve operations
ReservePool, Splitter, KpiRegistry, and related helpers are easier to evaluate for RWA operating workflows.
Impact
Teams can choose the right helper before wiring distribution, compensation reserves, KPI updates, and event queries into an app.
Changes
- Use ReservePoolHelper to review liquidity and compensation buckets, buy-backs, and sweep operations
- Use SplitterHelper to review recipients, shares, and distribution events
- Use KpiRegistryHelper to register KPIs, push values, and evaluate thresholds
Contract safety guidance for RWA operations
Role management, timelocks, emergency pause, whitelists, and upgrade boundaries are easier to review during implementation.
Impact
Production reviews can more easily verify who can pause what and which changes require delayed execution.
Changes
- Grouped roles such as Guardian, Admin, Treasurer, and Oracle around operational responsibility
- Clarified when to use EmergencyPauseManager and TimelockController
- Improved navigation into Whitelist, MarketManager, ReservePool, and other core contract responsibilities
SDK paths for RWA application builders
@hazbase/factory, auth, react, relayer, storage, and zk are organized by implementation purpose.
Impact
Builders can pick SDK packages by phase: issuance UI, authentication, gasless execution, evidence storage, and ZK proofs.
Changes
- Use Quick Start to review initial connection and call patterns
- Use Packages to understand each SDK responsibility and composition
- Use helper pages for implementation-level contract operation code
Wallet-session and signing considerations for Extension integrations
Added implementation considerations for permissions, signing confirmation, session continuity, and failure recovery in RWA user flows.
Impact
Apps serving investors, issuers, and operators can better design role-aware transaction controls.
Changes
- Clarified role and permission checks after wallet connection
- Outlined what to show before signing: action, target contract, and risk
- Added recovery considerations for expired sessions, rejected signatures, and network mismatch