Orkid

Changelog

Product, API, SDK, and infrastructure release history.

2026-09-23

Added

  • Permissionless sandbox: route quotes and dry-run solve on sandbox.orkidlabs.com work with no API key — one curl gets a real quote. Anonymous callers are rate-limited per IP (60 req/min); a sandbox key still raises the limit to the pilot 300 req/min. The proxy now accepts both /v1/* and /api/v1/* paths, so the SDK and the ElizaOS plugin work against the sandbox unchanged.
  • Rebate operations: rebate float reconciliation monitor, partner payout addresses, and ops endpoints.
  • Quote integrity gates: phantom-liquidity USD-ratio check on route and solve, external-price-guided greedy-walk rescue, and spot-gate phantom detection — corrupted or implausible pool state can no longer produce executable-looking quotes.

Fixed

  • Base routing outage: a single stale pool inside a token-pair macro-edge could veto the entire edge; over days this silently killed all Base routing. Edges now require only one fresh member pool — per-pool staleness is still enforced at simulation time.

Changed

  • Solver execution stack upgraded to Tycho 0.418.0.
  • ElizaOS plugin distribution: upstream elizaOS is retiring the community plugin registry (elizaOS/eliza#32219) and closed all third-party listing PRs — including our plugin-orkid submission, which had passed review. Both plugins remain published on npm under @orkid-labs; install via bun add / npm install and wire in the agent character's plugins[]. See ElizaOS plugins.

2026-09-21

Fixed

  • Route quotes could return impossible output amounts when an upstream pool's indexed state was corrupt — affected components are now excluded at ingestion and routing falls back to remaining liquidity for the pair.
  • volumeUsd in route/solve responses is now priced live — non-stable inputs are shadow-quoted against USDC through the pool graph instead of a static table (WETH was hardcoded at $3,500; other tokens returned $0).

Changed

  • Solver execution stack upgraded to Tycho 0.410.0 — settlement calldata now builds against the V3.1 router, and Ethereum routing ingests the Titan propAMM price-level stream for deeper mid-block liquidity.

Docs

  • Added the GET /api/v1/tokens endpoint reference — the serveable token list per chain.

2026-09-20

Added

  • Self-hosted secrets management: environment and credential storage moved in-house to a self-hosted Infisical deployment on Orkid-operated hardware — no cloud-hosted secret storage. Reachable only over the private tailnet; human access is gated by wallet-signed access permits (EIP-712) against an allowlisted operations wallet set, with replay-resistant nonces and HMAC session cookies enforced at the edge.
  • Ops mail infrastructure: inbound catch-all routing and transactional outbound for orkidlabs.xyz (Cloudflare Email Routing + Resend), plus API access to the ops mailbox for alerting/notification tooling.
  • ERC-6909 depository on Base mainnet: modified depository contract deployed at 0x300eb5e90b453a378f63bacdadb843fb76eaadc8 — rebate float deposits book to the public-books partition; float-deployment yield accrues to the reserves partition in the origin asset on the origin chain.
  • Nightly encrypted backups: Infisical datastore backs up to R2 on a cron schedule, encrypted at rest.

Changed

  • Service secret sourcing: all backend services (settlement gateway, per-chain solvers, relays, sandbox proxy) now load their environment from Infisical at boot into memory-only runtime files. Plaintext .env files removed from the host and from git tracking; an encrypted archive is retained for disaster recovery. ~800 secrets migrated under end-to-end encryption.
  • Frontend deploy pipeline: scripts/deploy-vercel.sh builds the frontend env from Infisical (prod /frontend) at build time and aborts if any [SENSITIVE] placeholder slips in — Infisical is now the source of truth for builds.
  • Branch CI gate: rust-ci workflow gates main, router-v2-rollback, and feat/** pushes on the self-hosted runner; pull-request jobs are restricted to same-repo branches and run clean checkouts.

Security

  • Wallet-permit gate verified end-to-end (valid signatures accepted, invalid/replayed/tampered rejected) on desktop and mobile signing paths.

2026-09-19

Added

  • Rebate operations (internal): float-reconcile monitor, partner payout addresses, and ops endpoints for rebate ledger management; depository read/write RPC endpoints split for reliability.

Changed

  • Hedera-settle UI panel gated to Base Sepolia while the mainnet settlement path is finalized.

Fixed

  • Private-relay send path now has fail-closed test coverage — relay failures can't silently drop fills.

2026-09-18

Added

  • Cross-chain settlement (new API surface): /api/v1/bridge/* — bridge curated major assets between Ethereum, Base, Arbitrum, and Polygon via Across. Non-custodial by construction: Orkid never receives or holds user funds — the wallet signs the ERC20 approvalTxns and the swapTx deposit directly against canonical Across contracts, with the depositor pinned as both recipient and refund beneficiary on the origin chain. Five endpoints: bridge/chains, bridge/tokens, bridge/quote, bridge/status, bridge/track. Quotes carry a 10 bps Orkid app fee in the output token, disclosed in the response's fees block. See Cross-chain bridge.
  • @orkid-labs/sdk@0.3.1: getBridgeChains(), getBridgeTokens(chainId), getBridgeQuote(request), getBridgeStatus(params), trackBridgeDeposit(request) plus all bridge types; openapi.yaml now covers the bridge endpoints. (0.3.2 followed with self-serve key docs.)
  • @orkid-labs/widget@0.3.0: the embeddable widget gains bridge mode — a destination-chain selector engages it whenever it differs from the origin chain, with curated token lists, a quote card (expected/minimum out, fill estimate, escrow + refund explainer), sequential approval→deposit signing, and live status polling. New callbacks: onBridgeQuote, onBridgeSubmitted.
  • @orkid-labs/plugin-orkid@2.1.0: ORKID_BRIDGE_QUOTE and ORKID_BRIDGE_STATUS actions for ElizaOS agents (quote-only — the user signs the deposit from their own wallet).
  • CLI: orkid bridge and orkid bridge-status commands.
  • Self-serve API keys: instant key issuance for evaluation tiers; 30-day anchored rebate windows for partner volume tracking; asset-denominated payout manifest per the rebate specification.
  • Partner API surface: partner endpoints, quote-event split for telemetry, and multi-chain fee routing.
  • Chain-aware depository selector: frontend picks the correct depository contract per chain (Base mainnet + Sepolia).
  • Ops monitoring (internal): fill-watch service + Discord webhook relay pushing EXECUTED/CONFIRMED events; solver alerts page to Discord.
  • Sandbox proxy: dry-run API surface for integrator evaluation without touching production paths.
  • Site: multi-chain copy, competitive-positioning SEO pages, brand font system, embed and hosted widget pages.
  • @orkid-labs/widget@0.2.1: README examples use generic partner placeholders; docs-site GitHub links corrected to the orkid-labs org.
  • Aave flash liquidity (internal): verified Ethereum aToken map wired as an additional flash source.

Changed

  • Executor fee: set to 30 bps; completed the Tycho 0.346.1 API migration across the workspace.
  • Polygon same-chain swaps are temporarily paused while solver private-relay infrastructure is completed; Polygon remains fully available for cross-chain bridging.

Fixed

  • Ingestor surfaces V4 pool decode errors and skips zero-liquidity V4 pools instead of failing silently; repaired invalid CI workflow files causing startup failures.

2026-09-17

Changed

  • Execution infrastructure: migrated swap execution on Base and Ethereum to the current TychoRouterV3 deployments. Tycho retired the previous V3 router contracts by pausing them on-chain; all four production chains now run the latest router build. No API or SDK changes — route and solve request/response shapes are unchanged.
  • Liquidity sourcing (internal): solver now evaluates multiple flash-liquidity venues per backrun (Balancer, Morpho, Aave V3) and selects the fee-adjusted optimal borrow size rather than borrowing the vault maximum — improves execution capacity on large dislocations.
  • Atomic backruns (internal): per-chain backrun execution wired to flash-loan liquidity with fork-verified Base/Arbitrum replays; per-chain router ABI encoding for the new V3 layout on Arbitrum and Polygon.
  • Site: landing page now lives at the apex domain instead of redirecting to /swap.
  • @orkid-labs/widget@0.2.0: multi-chain support and Permit2/wallet fixes.
  • React 19 compatibility: framer-motion bumped to 12.x and React-19-incompatible libraries isolated behind ssr:false client boundaries; embed, hosted, and partner pages ungated.

2026-09-16

Added

  • Wallet connectors: swap UI gains a connector picker (injected wallets + WalletConnect); CSP allows the Orkid RPC endpoint.
  • RFQ liquidity (internal): Metric public RFQ client registered on all chains; Arbitrum token lists feed indicative price streams.

Changed

  • Solver selects executor by request source — retail sandbox vs partner production get distinct execution paths.
  • Price-impact computation now uses a USD-notional threshold; protocol gating self-heals when indexers re-add support; solver tolerates dead Tycho extractors without stalling.
  • Widget follows the wallet's chain on connect instead of forcing Base; auto-resumes swaps after Permit2 approval; reads allowance imperatively; chain-aware gasless threshold text (Base $20 / Ethereum $200).

Fixed

  • Widget: signed-shift bug could produce negative Permit2 nonces.

2026-09-15

Added

  • Private relay path (internal): solver can route bundles through private relays on public-mempool chains — groundwork for re-enabling Polygon.

Changed

  • Polygon temporarily paused in the chain selector with a downtime notice shown to users.

2026-09-12

Changed

  • Breaking (minor): @orkid-labs/sdk@0.2.0 — OrkidViemPermitSigner and OrkidEthersPermitSigner moved out of the root entry point into @orkid-labs/sdk/viem and @orkid-labs/sdk/ethers subpath exports. The core SDK is now dependency-free; signers require viem or ethers only when their subpath is imported. Migration: change import { OrkidViemPermitSigner } from '@orkid-labs/sdk' to import { OrkidViemPermitSigner } from '@orkid-labs/sdk/viem'.
  • Bumped @orkid-labs/plugin-orkid to 2.0.4 — consumes SDK 0.2.0 and drops the ethers workaround dependency.

Fixed

  • SDK root bundle no longer hard-requires ethers despite declaring it an optional peer — clean installs without wallet libraries now work.

Added

  • Published @orkid-labs/plugin-orkid — ElizaOS plugin for Orkid swaps (quote, execute, dry-run, confirm, tokens, usage, market data). Submitted to the ElizaOS registry.
  • Published @orkid-labs/plugin-mempalace — ElizaOS plugin for persistent agent memory via MemPalace MCP. Submitted to the ElizaOS registry.

2026-09-11

Fixed

  • Corrected GitHub repository URL in npm package metadata — both @orkid-labs/sdk and @orkid-labs/widget now point to github.com/orkid-labs/orkid-sdk.
  • Fixed widget source imports — @orkid/sdk → @orkid-labs/sdk (would have broken consumers importing the widget).

Added

  • Full test suites for both packages:
    • SDK: 72 unit + integration tests (chains, permit, client, HTTP mocking, error handling, handshake recovery) + 8 e2e tests (live API, skipped by default).
    • Widget: 26 unit + integration + e2e tests (theme, embed, provider context, DOM mount, unmount cleanup).
  • vitest dev dependency and npm test / npm run test:watch / npm run test:e2e scripts in both packages.
  • Created github.com/orkid-labs/orkid-sdk repository for SDK and widget source.

Changed

  • Bumped @orkid-labs/sdk to 0.1.2.
  • Bumped @orkid-labs/widget to 0.1.2.

2026-09-10

Added

  • Published @orkid-labs/sdk@0.1.0 to npm — TypeScript SDK with OrkidClient, OrkidPermitSigner, and CLI.
  • Published @orkid-labs/widget@0.1.0 to npm — white-label React swap widget.
  • Launched embed generator for zero-code integration.
  • Launched hosted swap pages for zero-integration partners.
  • Added partner_configs table for per-partner widget branding.
  • Added GET /api/v1/partner-config?slug= endpoint for hosted page config.
  • Added Arbitrum and Polygon chain support (TVMExecutor V2 + Tycho Router V3).
  • Added sandbox environment at sandbox.orkidlabs.com.
  • Added SANDBOX_BASE_URL export to SDK.
  • Added dynamic fee tiers (volume-based, 4 tiers).
  • Added referral rebate tracking.
  • Added executed_at field for monthly accounting.
  • Added route event tracking (quote-only telemetry, separate from solve volume).

Changed

  • API keys are now sales-led — contact api@orkidlabs.com to provision. No self-serve.
  • Fee schedule is now tiered and competitive (contact Orkid for pricing). Fixed-fee claims removed.
  • SDK package name is @orkid-labs/sdk (not @orkid/sdk).
  • Widget package name is @orkid-labs/widget (not @orkid/widget).

Removed

  • Unichain from production chain list. Production chains are Base, Ethereum, Arbitrum, Polygon.
  • Fixed 9 bps fee references from all public documentation.

Brand Guide

Orkid design language — colors, typography, spacing, and principles.

On this page

2026-09-23AddedFixedChanged2026-09-21FixedChangedDocs2026-09-20AddedChangedSecurity2026-09-19AddedChangedFixed2026-09-18AddedChangedFixed2026-09-17Changed2026-09-16AddedChangedFixed2026-09-15AddedChanged2026-09-12ChangedFixedAdded2026-09-11FixedAddedChanged2026-09-10AddedChangedRemoved