DigiByte v9.26.0-rc33 Release Notes

WARNING: This is a TESTNET-ONLY release. DO NOT use on mainnet.

Development Branch: https://github.com/DigiByte-Core/digibyte/tree/feature/digidollar-v1

Join the Developer Chat: https://app.gitter.im/#/room/#digidollar:gitter.im

✅ SAME TESTNET — NO RESET

RC33 uses the same testnet23 chain as RC32. No reset, no new genesis, no network-magic change, no port change. Existing chain data, wallets, DD positions, and oracle keys carry forward.

Oracle operators running RC32 can drop in RC33 binaries and resume. There are no oracle key rotations in RC33.

What's New in RC33

RC33 is a massive DigiDollar hardening release on top of RC32. It ships the Red Hornet DigiDollar/oracle hardening work, the follow-up Red Hornet security campaign, Qt/DD wallet display fixes, stronger wallet/RPC/index/reorg accounting, deterministic oracle validation fixes, MuSig2 replay/resource hardening, mining-template fixes, and broader registered functional/fuzz/unit coverage.

The short version: RC33 fixes the bugs found after RC32, keeps the same testnet23, and makes DigiDollar mint/transfer/redeem/oracle behavior much harder to break before the next public testnet push.

RC33 fix summary since RC32

• DigiDollar transfer display fixed in Qt — local sendmanydigidollar receives now show up in wallet history, transaction rows display real DD amounts, and outgoing/incoming signs are preserved across the Overview and Transactions views.
• Qt DigiDollar layout polish — lock-tier text/columns no longer truncate important lock-period information.
• DigiDollar DCA and collateral rounding hardened — fractional DCA multipliers and satoshi collateral requirements now round conservatively instead of truncating below policy.
• DigiDollar consensus validation hardened — reordered mint outputs, ambiguous OP_RETURN metadata, transfer amount spoofing, redemption metadata ambiguity, and invalid mint side effects are covered by stricter validation.
• Wallet DigiDollar accounting recovery fixed — wallet state now survives rescans, restores, failed redemptions, pending redemption restarts, transfer reorgs, foreign mint discovery, and mixed/non-DD metadata edge cases more safely.
• RPC DigiDollar validation tightened — address validation, amount parsing, named-option defaults, redemption preflight, collateral quote bounds, estimate math, protection status, pending mint status, and selected-input DD change reporting are corrected.
• Qt DigiDollar safety displays fixed — watch-only receive handling, recoverable mint owner-key handling, position/redeem displays, and safety/status views were tightened.
• DigiDollar stats/index reorg behavior fixed — reordered valid mint outputs and reorged collateral-vault metadata are now accounted for consistently.
• DD dust policy corrected — DigiDollar protocol outputs that must be zero-value or special-form no longer get rejected/bypassed by generic dust assumptions in the wrong direction.
• Oracle block validation made deterministic — block validation no longer falls back to local oracle/mock/cache state when a deterministic block oracle price is required.
• Oracle cache/reorg handling fixed — oracle price cache updates roll back correctly across reorgs and avoid invalid-block side effects.
• Oracle stale-data handling tightened — stale pending messages, stale RPC status, stale miner-template bundles, stale pre-activation reloads, and retry edge cases are handled more defensively.
• MuSig2/oracle P2P replay hardening — duplicate signers, attestation replay poisoning, consensus replay hash poisoning, bundle replay hash bypasses, early partial-sig replay, and early partial buffer starvation were fixed.
• MuSig2 bitmap/roster handling hardened — epoch rosters are validated, bitmap extraction is bounded, and v0x03 bitmap script creation is more defensive.
• Mining and getblocktemplate fixed for DD/oracle commitments — DD block-template validation, oracle-price retry DoS behavior, and the oracle GBT schema were corrected.
• Mock/regtest oracle behavior aligned — mock oracle bundle timestamps and regtest bundle timestamp behavior now match the signing/validation expectations.
• Test/fuzz coverage expanded and registered — DD/oracle/MuSig2 parser, price, wallet, index, reorg, RPC, Qt, mining, and functional tests were expanded; previously missing DigiDollar/oracle scripts are now registered in the standard functional runner.
• Documentation updated for RC33 — DigiDollar/oracle docs and repo maps were aligned with the current RC33 code surface.

Red Hornet audit coverage included in RC33

RC33 includes the implementation fixes from two Red Hornet DigiDollar/oracle campaigns and the follow-up continuation pass.

Reference reports in this tree:

• reports/red_hornet_final_report.md
• reports/red_hornet_ledger.md
• reports/red_hornet_security_final_report.md
• reports/red_hornet_security_ledger.md

Fixed Red Hornet implementation ranges

Architecture / product decisions still intentionally open

These were not silently changed in RC33 because they require protocol, wallet-storage, oracle-liveness, or product-support decisions:

• ARCH-RH-001 — strict post-activation OP_ORACLE handling versus liveness escape hatches.
• ARCH-RH-002 / DD-RH-002 — whether IBD/catch-up skipOracleValidation can remain consensus-affecting.
• ARCH-RH-003 — final watch-only DigiDollar address storage/rescan/listing model.
• ARCH-RH-004 — ERR behavior and burn-validation design.
• DD-RH-034 — Qt mint owner-key generation/storage timing and HD recovery model.
• DD-RH-037 — mainnet active oracle roster size versus 17-slot bitmap/protocol capacity.
• DD-RH-069 — collateral-script policy for non-DD collateral spends after timelock without DD burn.
• DD-RH-075 — encrypted wallet-storage migration for oracle operator private keys.
• DD-RH-084 — mainnet active oracle roster IDs versus consensus/MuSig2 bitmap total.
• DD-RH-085 — whether Phase Three-active heights must reject v0x02 Phase Two bundles.
• DD-RH-086 — fail-open versus fail-closed behavior for malformed/unknown OP_ORACLE outputs.
• DD-RH-094 — MuSig2 signer reselection/retry policy for low-ID nonce-trimming liveness attacks.
• DD-RH-097 — network/genesis/deployment domain separation for MuSig2 signing.
• LEGACY-DD-WALLET — whether legacy wallets are unsupported for DigiDollar bech32m receive/mint, or need a compatible design.
• DD-RH-059-WALLET-STORAGE — wallet position storage still needs an approved schema path for arbitrary collateral vault output indexes.

1. DigiDollar consensus and accounting hardening

RC33 tightens the rules around how DD mint, transfer, and redemption transactions are interpreted:

• Valid reordered mint outputs are accounted for by structure rather than fixed output indexes where the affected path permits valid ordering.
• Transfer OP_RETURN metadata now has stricter amount/output matching so later spend extraction cannot be tricked by earlier fake metadata.
• Redemption metadata handling is less ambiguous and failed redemption attempts no longer mutate wallet state incorrectly.
• DCA and collateral math now round up where truncation could understate required collateral.
• Invalid mint attempts cannot poison volatility/system-health state.
• Non-DD metadata cannot be credited as DigiDollar balance.

This is the core “do not let accounting drift from consensus” RC.

2. Wallet, rescan, restore, and reorg fixes

RC33 fixes multiple wallet-side state recovery paths:

• Wallet-created local sendmanydigidollar receive rows are visible.
• senddigidollar reports actual selected-input DD change instead of whole-wallet remainder.
• DD transfer rows restore correctly across reorgs.
• Pending redeem state survives restart/recovery more safely.
• Foreign DD mints can be claimed during wallet rescans when the wallet controls the relevant key material.
• DD-locked inputs are rejected from normal preset-input wallet funding paths.
• Address validation is network-aware so wrong-network DD addresses are not accepted in the wrong context.

3. RPC hardening

RC33 tightens DD and oracle RPC behavior:

• getprotectionstatus / DD protection status no longer reports false emergency state with no DD liabilities.
• calculatecollateralrequirement rejects amounts that mint validation would reject.
• estimatecollateral removes overflow-prone dead math and keeps returned USD value tied to the requested DD amount.
• redeemdigidollar amount parsing, redemption address handling, and preflight checks are safer.
• Named option defaults are corrected.
• Oracle RPC status avoids reporting stale oracle state as fresh.
• getblocktemplate includes the corrected oracle schema behavior.

4. Oracle and MuSig2 hardening

RC33 significantly hardens the oracle path:

• Block validation uses deterministic block oracle data, not local fallback state, where consensus validation requires a block price.
• Oracle cache updates roll back correctly on reorg and avoid invalid-block side effects.
• Stale pending oracle messages and stale template bundles are cleared/refused more defensively.
• Epoch roster validation and MuSig2 bitmap bounds were tightened.
• Duplicate signers and replayed attestations/bundles/partials are rejected in more places.
• Early MuSig2 partial-signature handling no longer allows replay/buffer starvation behavior.
• Miner oracle-price retry behavior no longer creates a DoS loop.

5. Qt DigiDollar fixes

RC33 includes visible Qt wallet polish and safety fixes:

• DD transaction rows show DD amounts instead of misleading DGB/zero display.
• Overview send/redeem prefixes show the right sign.
• Lock-tier columns have enough width to avoid truncation.
• Watch-only DD receive addresses and recoverable mint owner-key displays behave more safely.
• History signs are preserved in the main transactions tab.

6. Validation results

Known exploratory limitation from the reports:

• digidollar_basic.py --legacy-wallet cannot generate a bech32m DigiDollar address. This is recorded as a legacy-wallet support decision, not as a fixed RC33 vulnerability.

Upgrade Path

RC33 is a drop-in binary replacement on testnet23.

1. Stop the RC32 node or Qt wallet.
2. Install the RC33 binary.
3. Start with the same data directory and wallet.
4. Keep txindex=1 enabled for DD nodes.
5. Oracle operators: load/unlock the same oracle wallet and run startoracle <your_oracle_id> if auto-start does not resume.

No chain reset or wallet migration is required.

Manual oracle start if needed:

digibyte-cli -testnet loadwallet "oracle"
digibyte-cli -testnet -rpcwallet=oracle startoracle <your_oracle_id>

Encrypted wallet operators should unlock first:

digibyte-cli -testnet -rpcwallet=oracle walletpassphrase "your passphrase" 600
digibyte-cli -testnet -rpcwallet=oracle startoracle <your_oracle_id>

Oracle Operators (RC33)

No oracle slot changes from RC32.

Network Information

Configuration

testnet=1

[test]
digidollar=1
txindex=1
algo=scrypt
addnode=oracle1.digibyte.io

Note: txindex=1 is enforced at startup for DD-enabled nodes. Make sure it is in the correct section ([test] for testnet, [main] for mainnet). Global placement above all sections also works.

Scrypt CPU mining against local Qt/node

For local testnet scrypt mining, both the node and miner must agree on scrypt:

[test]
algo=scrypt

Start the miner with the scrypt flag explicitly:

cd /path/to/cpuminer
./minerd -c dgb-solo-mining.json -a scrypt -t 12

Healthy mining output includes:

• 12 miner threads started, using 'scrypt' algorithm.
• Long-polling activated for http://127.0.0.1:14026/
• no repeated HTTP 401/500 errors.

Downloads

Binaries attached to the GitHub release once Guix builds complete and are verified.

Troubleshooting

"My oracle did not start automatically"

Load and unlock the oracle wallet, then start manually:

digibyte-cli -testnet loadwallet "oracle"
digibyte-cli -testnet -rpcwallet=oracle walletpassphrase "your passphrase" 600
digibyte-cli -testnet -rpcwallet=oracle startoracle <your_oracle_id>

"My DD transfer history looks different after RC33"

RC33 fixes several wallet/Qt display paths. Local sends to your own DD addresses, sendmanydigidollar receives, and main transaction rows should now show clearer DD in/out rows and signed DD amounts.

"A collateral quote now fails before minting"

That is intentional when the quote is outside live mint bounds. RC33 makes calculatecollateralrequirement match mint validation instead of quoting impossible mints.

"A legacy wallet cannot create a DigiDollar receive address"

Legacy wallet support for DigiDollar bech32m receive/mint remains a product decision. Descriptor wallets remain the tested DD wallet path.

"Node refuses to start: oracle roster alignment mismatch"

That guard is intentional. It means local chainparams have inconsistent oracle public-key/roster data. Run an official RC33 binary and do not hand-edit chainparams.

Commits Since RC32

Feedback & Community

• Developer Chat (Gitter): https://app.gitter.im/#/room/#digidollar:gitter.im
• GitHub Issues: https://github.com/DigiByte-Core/digibyte/issues