Core v6.3.8

Release Date: April 23, 2026 Tags: UI, FINANCE, REDESIGN, TRADE, ACCESSIBILITY, AUDIT, BUG-FIXES, MONEY-FLOW, WALLET-ACCOUNTING

Overview

Version 6.3.8 ships two things at once.

First, a complete end-to-end redesign of the Finance section so it matches the polish of /trade and /binary. Every page under /finance/* was rebuilt on a new shared design system: wallet dashboard, per-currency wallet detail, deposit (Fiat / Spot / Eco), withdraw, transfer, and history.

Update Instructions

After updating, run the following command in terminal:

pnpm updator

No environment variables are required. No database migration is needed.

Upgrade Notes

Orders that are already open keep settling the old way

• Changed: nothing you need to do. No migration was needed. Orders that were already open at deploy time continue to settle via their original accounting path — each pending order is checked for whether it was placed under the old or the new model and settled accordingly.

Added

Adjustable text size on the trade and binary pages

Client feedback flagged that several panels on /trade and /binary rendered text as small as 9–11 px, which is hard to read on high-DPI monitors. Both pages now have a Text Size segmented control in their in-app Settings dialog:

• Added four presets: S (0.9×), M (1.0× — default), L (1.15×), XL (1.3×), with a live preview block showing how each size renders.
• Added persistence per browser, so the choice survives reloads.

Destination tag / memo input for XRP, XLM, EOS, ATOM, HBAR, BNB (BEP2)

• Added a Destination Tag / Memo input to the withdraw form for the currencies that require one. It is shown only for those coins, is marked required, and Submit stays disabled until a memo is provided.

Admin finance — wallet row actions

The admin wallet page was previously read-only even though the endpoints for balance adjustment and status toggle already existed. Both are now wired into the admin UI as row actions:

• Added Balance Adjust, which opens a dialog (Add / Subtract, amount, description, optional "notify user").
• Added a Status toggle that enables or disables the wallet with one click.

Trading-bot and strategy marketplace notifications

The following events were previously silent. Users now receive a notification when:

• A trading bot stops because of a critical error.
• A trading bot stops because it hit its risk limit.
• A trading bot is stopped by the cron because its worker process became unresponsive.

Strategy creators on the marketplace receive a notification when their strategy is approved, rejected, or suspended. Leaders in the copy-trading system receive a notification when their account is reactivated by an admin.

Transactional emails

• Added dLocal deposit confirmation and failure emails. A dLocal deposit completing or failing was previously silent.
• Added a welcome email per user on bulk CRM user import, sent without blocking the import itself.

Changed

Finance redesign

Every page under /finance/* was rebuilt on a new shared design system. Validation, KYC, precision logic, and every money-handling code path are unchanged on the redesigned pages — if your finance flows worked before, they behave identically now. They just look and feel premium.

A consistent color code is used everywhere: FIAT = emerald, SPOT = blue, ECO = violet, FUTURES = amber. Badges, cards, gradients, and glows all pull from the same palette.

Wallet dashboard

• New hero card with large total balance, hide/show toggle, 24-hour delta chip, allocation stacked-bar by wallet type, and three primary actions (Add Funds / Withdraw / Transfer).
• Quick-action grid for Deposit / Withdraw / Transfer / History.
• Improved styling on Pending Transactions (online/offline indicator, glass look).

Wallet detail

• Themed hero that follows the wallet type's color.
• Large balance with hide toggle, an "in order" lock chip when funds are locked, and four quick metrics (Balance / Locked / Total / Type).
• ECO wallets: network selector, QR code, copyable address, and a clear "send only X on Y network" warning.
• Inline transaction history.

Deposit

Each step is its own card with a numbered header, tied together by a visual stepper:

• Wallet type selector with gradient-themed cards.
• Searchable, paginated currency grid.
• Deposit method selector split into Payment Gateways / Manual Methods / Blockchain Networks.
• Fiat deposit with large amount input and gateway-driven payment buttons.
• Spot deposit with QR + address layout, monitoring screen with countdown, and a clearly highlighted "transaction hash required" panel.
• Eco deposit with QR + address layout plus a live confirmations progress bar and explorer link.
• Full-page success / error states with status badges, copyable hashes, and primary/secondary actions.

Withdraw

• Same step-card pattern as Deposit.
• Big-typography amount input with min/max chips.
• Fee summary card with a prominent "you'll receive" / "amount to send" emerald row.
• Tooltip-driven submit button that still exposes the same disabled reasons as before.
• Premium success state with "View History" and "Make Another Withdrawal" actions.

Transfer

• Two large gradient mode cards (Between wallets / To another user).
• Source and destination wallets selected via gradient pills colored by wallet type.
• Recipient input shows live validation status (validating / found / not found).
• Transfer summary panel with cross-currency exchange rate, USD reference prices, fee, and final receive amount.
• Success state with from/to direction cards and copyable transfer IDs.

History

• Wrapped with the new page header. Same data and same table — just consistent chrome.

Wallet accounting — one "available vs locked" model across the platform

A deep audit of every money-flow path uncovered three classes of issues: wallet availability was being computed inconsistently (sometimes double-subtracting locked funds), open spot and binary orders weren't reflected in the "locked" portion of the wallet, and the spot fill reconciler only ran while a user had a browser tab open. This release rebuilds those flows on a single consistent model.

The model

• Available balance — what you can withdraw, transfer, or commit to a new order.
• Locked — currently committed to something that hasn't settled yet: an open spot limit order sitting on the exchange, an active binary option, an open P2P sell offer, or a held margin on a futures position.

Available + Locked = your total owned. Anything that reads "available" now agrees on what that means, so withdraw/transfer/trade checks exclude locked funds and the wallet UI correctly shows how much capital is tied up.

What this changes for users

Binary stakes now show as locked. When you place a binary option, your stake moves from available to locked until the option resolves. Previously it was silently removed from available and wasn't visible anywhere in the wallet UI — it looked like the money had vanished until the option settled. Now you can always see it.

Spot limit orders now show as locked. Same story. If you place a limit BUY on BTC/USDT that hasn't filled yet, the USDT cost sits in "locked" on your wallet until the order fills or you cancel it. Market orders are unaffected since they fill instantly.

Withdraws and transfers correctly see only free funds. Previously, any funds locked in a P2P offer could make the withdraw flow show an incorrect available amount (sometimes double-subtracting, so the user couldn't withdraw even their genuinely-free portion). The withdraw, transfer, and trade-submit flows now all use the same available-balance check.

Settle paths on binary orders handle wins, losses, and draws cleanly. Each outcome uses the right combination of releasing the held stake and crediting the profit (on WIN) or consuming the held stake (on LOSS). Draw returns the stake intact. Partial-payout binary variants (TURBO) release the paid portion and consume the rest.

Admin panels

• Changed the admin notification metrics to track per-channel failure counts (IN_APP, EMAIL, SMS, PUSH) as well as per-channel sends, so success-rate numbers are accurate instead of always showing 100%.
• Changed copy-trading leader statistics: "total allocated by followers" was hard-coded to zero on every leader profile. It is now a real sum over active follower allocations, and leader ROI is computed from the per-follower breakdown with price conversion instead of a stale figure.
• Changed the Authorize.Net deposit path to treat the server-to-server "Silent Post" webhook as the primary trust path, with the browser return URL as the fallback for sessions where the webhook was delayed or missed. Documentation previously implied the webhook was a future item; a substantive handler already ships, with signature verification, idempotent crediting, and handling for captures, refunds, voids, and fraud outcomes.

Fixed

Money-flow — admin transfer approve/reject no longer duplicates money

Previously, the admin "approve or reject transfer" action always credited the destination wallet regardless of which status was set. Marking a transfer REJECTED both rejected it from the sender's perspective AND credited the recipient — duplicating money on every rejected transfer.

Now: destination is credited only on COMPLETED. REJECTED/CANCELLED refunds the sender's wallet and does not touch the destination, so the sender gets their money back automatically instead of an admin having to issue a separate manual credit.

Money-flow — admin cannot mark a withdrawal complete without a reference

Admin withdrawal approval previously allowed setting status to COMPLETED without any on-chain transaction hash or bank wire reference. The record would say "paid" while nothing had actually moved off-platform.

Now: COMPLETED requires a non-empty reference (tx hash for SPOT/ECO, wire reference for FIAT). Blocked otherwise.

Money-flow — wallet balance adjustments no longer silently merge

Previously, two legitimate repeat adjustments on the same wallet (e.g. +100 twice) collided on the same duplicate-detection key and silently deduped to a single credit. Now each admin click produces a unique operation.

Trade page — cancel / cancel-all / close-position work

The main /trade page had three broken order-management buttons that failed silently:

• Fixed Cancel order (spot).
• Fixed Cancel all orders (spot), which now iterates real cancels instead of calling the wrong endpoint.
• Fixed Close position (futures).

Users no longer see "failed to cancel" toasts on actions that should succeed.

Binary page — cancel order works; early-close now has a clear message

• Fixed the binary cancel button pointing at the wrong address.
• Fixed the early-close button failing silently against something that does not exist. It now shows a clear "Early close is not yet available — please wait for expiry" message.

CMS pages work again (about, privacy, custom marketing pages)

• Fixed sites running in CUSTOM landing-page mode returning a 404 for every CMS-built page, caused by the frontend and backend disagreeing on how a page is identified. All builder-created pages now resolve correctly.

Phone verification actually verifies now

The phone verification tab was shipped as a non-functional demo stub: stand-in functions in place of the real account and API calls, a phone check that could never pass, and a broken paste handler. Users saw a 2-second delay and a "success" message but nothing was ever verified.

The tab is now fully wired to the real backend; users can actually verify their phone number.

Referral landing ("John Doe invited you") works

• Fixed the register form showing only the raw referral code when a signup link includes ?ref=.... It now fetches and displays the referrer's name and avatar.

Discount codes are now actually validated

• Fixed the ecommerce cart accepting invalid discount codes because it never checked the validation result. Invalid codes are now rejected — a real revenue leak, now closed.

NFT admin — disable controls + dispute moderation work end-to-end

Admin does not create, edit, or remove NFT content (that's user-side), but must be able to disable resources and moderate disputes. The entire NFT admin surface now has working status toggle columns for auctions, listings, offers, tokens, collections, and creators. The dispute admin page — which was calling seven endpoints that did not exist — is now fully functional: stats, message thread, status / priority / assign / resolve / message.

The activity log's Delete button also works now.

NFT marketplace — search, sort, "Ending Soon", and "Has Offers" actually filter

• Fixed these four controls doing nothing because the backend did not read their parameters. All four now filter the listing correctly.

NFT collection detail — tokens actually show up

• Fixed every collection detail page showing an empty token grid, caused by a mismatch between what the page expected and what the backend returned. Tokens now render.

ICO dashboard — real investment rows

• Fixed the "Recent Investments" list on the ICO dashboard being permanently empty. It now shows the customer's ICO investment history with per-row P&L.

Admin ecommerce order — shipping address no longer gets erased on save

• Fixed the order edit page overwriting the customer's shipping address with blanks when an admin clicked Save, because it blanked the address fields on load. It now populates from the saved address.
• Fixed admin order status changes not triggering inventory restock on CANCEL.

Deposit cancel actually cancels

• Fixed the Cancel button on pending deposits calling something that did not exist. It now cancels.

Investment dashboard — stat cards and Recent Investments include all statuses

• Fixed the dashboard counting only ACTIVE investments, so "Completed" was always 0 and completed, cancelled and rejected investments never appeared in the list. All statuses are now included.

Many other smaller fixes

A long list of smaller issues were closed along the way — dead links pointing to removed pages, admin buttons calling addresses that no longer exist, stray characters showing up literally in the interface, URL casing mismatches, block/unblock sending the wrong kind of request, approve/reject buttons hitting the wrong addresses, dead emergency-stop buttons that did nothing, and so on. None of these individually break the site but together they made the admin panels feel flaky — the audit removed them systematically.

Reliability fixes for spot orders

New 60-second reconciler for spot fills. Previously, the only thing that noticed when a spot limit order filled on the external exchange was a handler running in the user's browser. If the user closed the tab before the order filled, the fill was never reflected in their wallet. Now a server-side sweep runs every 60 seconds, checks open spot orders against the external exchange, and credits fills, refunds cancellations, and handles partial fills regardless of whether the user is online.

Partial-fill-then-cancel is now handled correctly. If a spot order is 50% filled on the external exchange and the user cancels the remainder, the filled 50% is now credited (counter-asset + platform fee) AND the remaining 50% of the input currency is refunded. Previously the filled portion was silently dropped.

Spot trading fees are now recorded. Platform fees taken on spot fills now route through the same admin-profit accounting as every other fee on the platform. Previously spot fees were deducted from the credited amount but never recorded in admin profit.

Binary cancel errors no longer swallowed silently. Errors from the cancel service were being discarded, so the caller believed a cancel had succeeded when it had not.

Platform fees now actually reach the platform wallet

Six separate flows were deducting a fee from the user but not depositing it anywhere. Reports would show "revenue" on paper that wasn't present in any wallet — reconciliation against the Super Admin balance would not add up. All six are now routed through the same platform-fee collector that every other fee uses, so admin-profit records and actual wallet credits stay in sync:

• ICO purchase fees — fee portion was deducted from the buyer's payment with no corresponding credit.
• Forex deposit and withdrawal fees — fee math ran at submission but the platform was never credited.
• Futures trading fees — taken off the payout but not captured.
• Binary option losses — stake was removed from the user's wallet on a total loss but the house take was not recorded anywhere.
• Ecommerce order revenue — buyers were debited with no corresponding revenue credit on the platform side.
• Staking admin earnings — the admin-fee portion of each distribution created a ledger row marked unpaid but never actually credited the Super Admin wallet.

Three additional direct "admin profit" ledger writes in the wallet utilities were also replaced with the unified fee-collection flow, so every admin profit record now has a matching wallet credit created at the same moment.

ICO principal now held in escrow

On ICO purchase, the buyer used to be debited with no trace of where the money went until the admin manually released it. The principal now credits a Super Admin escrow wallet at purchase time. On admin approval the escrow transfers to the offering owner. On admin reject, manual cancel, or soft-cap failure, the escrow refunds the buyer. The buyer's money is always traceable to a concrete wallet position at every step.

ICO vesting amount is now locked once a schedule exists

• Fixed an ICO transaction's amount being editable after vesting had already been scheduled, which left vesting paying against the old figure. The amount is now immutable once any vesting rows reference it, enforced both in the admin editor and at the data layer.

NFT offers now require an escrow

Offers previously wrote to the database with no wallet commitment. A bad actor could spam thousands of offers at zero cost. Offer creation now holds the offer amount (plus any marketplace fee) against the buyer's wallet. Cancel, reject, and expire all release the held funds; accept settles the held funds to the seller, collects the marketplace fee, and releases the escrow on any competing offers that get auto-rejected. Admin cancel of an active offer also releases the buyer's escrow.

Ecosystem withdrawals now survive server restarts

The ecosystem withdrawal queue was held only in memory. If the server restarted between a user clicking Withdraw and the queue worker picking it up, the transaction stayed in PENDING forever — the user had already been debited but the on-chain send never fired. On startup every PENDING ecosystem withdrawal is now re-queued, and a 5-minute watchdog catches anything stuck.

Futures liquidations and closes are now atomic across both data stores

Position state lives in Scylla; the user's wallet lives in MySQL. Liquidation and close used to flip the position first, then credit the wallet. A failure after the first step meant the position was closed in the orderbook but the realized PnL never made it to the wallet. The order is now reversed: the wallet is credited first, then the position state is updated with retry and backoff. If the position update ultimately fails the user's money is already correct, and a new futures position reconciler sweeps recently-credited positions whose status never got replayed and catches them up.

Live trading bot actually moves money now

• Fixed the "live trade" path in the trading bot engine updating the bot's allocation counter without making the underlying wallet move, so live bots in production were skipping accounting entirely. The buy path now debits the quote currency and credits the base, the sell path does the reverse, and a failure rolls everything back cleanly.

Fiat webhook status now flips only after the wallet credit lands

• Fixed eight fiat gateway verification handlers (Mollie, Klarna, Authorize.Net, 2Checkout, Adyen, dLocal, Paystack, Paytm) marking the transaction COMPLETED before actually crediting the wallet. If the credit step failed, the record read "paid" but no money had moved. All eight now credit the wallet and flip the status together — either both happen or neither does.

Retry-safe operations — no more double-debits from network retries

A number of wallet operations had duplicate-detection keys that changed between retry attempts, so a dropped response that the client retried would produce a second debit. Every such case is now anchored on a stable identifier so retries collapse safely:

• Forex deposits and spot + fiat withdrawals accept a one-time value from the browser, sent automatically, so a dropped response retries into the same operation.
• Copy-trading follower allocations, internal transfers, and investment purchases are now keyed on records created first, so a cancel-then-reinvest of the same amount correctly opens a new investment rather than silently deduping.
• Admin wallet balance adjustments mint a per-adjustment anchor when the browser supplies none, so repeat adjustments don't collide.
• AI investment payouts now bind the WIN/LOSS/DRAW outcome into the key, so a same-day result flip produces the correct payout.
• P2P offer edits, ecosystem withdrawals, and staking claims also had their keys hardened so edge-case collisions are no longer possible.

Concurrency — row locks where they were missing

Several multi-step money operations fetched wallet records without a lock, opening race windows where two concurrent requests would read the same balance and each pass validation. Internal transfers, ecosystem matching, ecosystem alternative-wallet selection, and P2P trade-related wallet lookups now all take a proper lock, eliminating the last of the balance-check-then-update races.

Network calls moved out of operations holding a wallet lock

Two hot-path handlers held a wallet lock across a network call — a binary-option ticker fetch during order creation, and a queue push during copy-trading order placement. Under load this produced lock-wait timeouts and deadlocks, and in the copy-trading case a rollback could orphan the queued entry. The ticker fetch now happens before the lock is taken; the queue push now runs after the wallet write has committed.

Smaller correctness polish

• Fixed ecosystem available-amount calculation not filtering by network, so PERMIT-token availability was mis-summed across networks.
• Fixed P2P trade cancel not restoring the parent offer's total, so popular offers accumulated phantom commitment after a string of cancelled trades.
• Fixed forex withdraw daily and monthly counters incrementing on submit, so a submit-then-reject cycle silently leaked counter capacity. They now increment only on admin approve, and admin reject refunds the full debited amount (principal + fee) instead of short-refunding the fee.
• Fixed ecommerce admin rejects and refunds reversing only the buyer debit and not the platform fee collected at order time. Marking an order REFUNDED from COMPLETED now requires an explicit admin override, to prevent accidental refunds on already-fulfilled orders.
• Fixed investment cancel destroying the original debit record. It now records the cancellation and creates a separate refund entry, preserving the audit trail.
• Fixed the trading-bot used-amount counter being incremented in a way that two concurrent trades on the same bot could race into an inconsistent state.
• Fixed admin NFT category edit and delete being disabled, because the backend exposed those actions at a slightly different address than the admin table expected.