Changelog

Every fix and update to the NexusPool core, with its date. The current stable version is highlighted.

v0.9.26Current · stable2026-08-31

Share grading: a share is now always graded against the exact block contents it was mined on. A rebuild that kept the same job identity could leave a share scored against contents no rig ever saw.
Share grading: asking for a different difficulty mid-session no longer rebuilds the job underneath the shares already in flight. The new difficulty is sent on its own and applies to the next job.
Duplicate detection: the per-job record of shares already seen no longer stops learning once it fills. Past that point a share could be sent again and counted again for the rest of that job.
Difficulty tuning: a rig whose recent history has gone stale now returns to a difficulty matched to what it is actually doing. It could previously stay pinned near a floor set from history that no longer applied.
Difficulty tuning: a rig that goes quiet no longer has its difficulty dragged down by the silence. A brief outage used to cost several shares at the wrong difficulty on the way back.
Difficulty tuning: the difficulty a rig is served no longer depends on how large that rig is. Small rigs were consistently served a harder target than their real rate justified.
Block detection: a winning share whose job rotated is no longer discarded before it is tested. The job now carries the template it was built from instead of naming it.
Late shares: a share that arrives late is now recorded by its actual cause instead of one word covering three unrelated situations. Nothing about how shares are credited changes.
Declined blocks: the two reasons a block can be declined now have separate counters instead of sharing one. An operator can tell them apart without reading process output.
Connection limits: the per-address connection cap is now sized from the real fleet, and every refusal is counted. Refusals used to be invisible, so a wrongly-capped rig looked like a quiet one.
Share handling: the per-share cost of the main mining path was cut, and the work sent on a new block is now prepared once instead of per connection. No change to what miners receive.
Duplicate detection: duplicate shares are now recognised by region rather than by header contents, so two regions serving the same work no longer accuse each other.
Stability: an unauthorised connection could make the pool emit a malformed status record. It is now rejected cleanly. No effect on mining, share accounting, or payouts.
A miner can now choose the transactions in its own block, and the pool mines exactly that set. Previously the pool substituted its own template, so the miner's choice was silently discarded.
A declared job is not accepted until a full node has judged it. The pool no longer answers "accepted" for a block no node has seen.
A job token is now usable only by the client it was issued to. Tokens also no longer run out under normal use.
A solution pushed over the declaration connection is now treated as a block and submitted, instead of being counted and discarded.
A declaring miner whose coinbase cannot be read is now told so, with the node's own words, instead of being asked to try again forever.
A rejection from the node no longer arrives as silence when its reason is long. The reason travels with the refusal so the miner can act on it.
A declaration whose coinbase is too large is now refused with that reason, before any of the expensive checking runs. It used to be dropped without a word, which read to the miner as the pool ignoring it.
Declarations are now paced per client, and a solved block is never held back by that pacing. A single client can no longer spend the whole pool's declaration capacity.
The pacing now follows the client rather than the connection, so reconnecting no longer hands out a fresh allowance.
A large declaration sent the way the protocol specifies is now read correctly. Clients that split one across several parts previously lost the session instead of having it accepted.
The landing page was rebuilt around verification: every claim now carries its own check, and the navigation collapses behind a single control on small screens.
A guided path now takes a new miner from the landing page to a correctly pointed rig, replacing a set of instructions that assumed prior knowledge.
Browser translation no longer takes the site down. A translated page used to blank out entirely; live figures are now marked so translation leaves them alone.
A failure in one part of a page no longer replaces the whole site with a black screen. The rest of the page keeps working.
The custody page was rebuilt so each published claim sits beside the evidence for it, instead of pointing elsewhere.
Support now has its own desk on the site, reachable from the four places people actually look for help.
A security contact is now published at the address researchers check first.
Search engines and AI crawlers now receive real per-page dates and a machine-readable index. Pages were previously dated by build time, which made every page look edited on the same day.
Signed-out readers are no longer bounced away from the receipt verifier, and the navigation search now signs you in instead of leading nowhere.
The connection details shown by the guided setup now match the address the landing page publishes. They could differ by region.
Scrolling no longer sticks on the technology page, and the footer artwork no longer competes with the page for the first seconds of a mobile load.
The verification key for receipts is now published where a script can fetch it, so a receipt can be checked without downloading anything from us first.
Pool status in the footer — height, hashrate, uptime and price — is now readable by a screen reader. It was hidden from one entirely, and it is the only copy of those figures on the page.
Closed answers in the frequently-asked list are now genuinely closed. A screen reader used to read every one of them aloud while the page reported them as shut.
The availability chart no longer places hundreds of unlabelled stops in the keyboard path. The detail behind each bar is now readable instead of silent.
The labels describing the connection key format now meet the contrast standard. Reading them is the step a miner takes to point a rig here, and they were too faint to pass.
The record of signed receipts and found blocks is now append-only at the operating-system level: it can be added to and read, never rewritten or deleted in place.
A copy of everything that cannot be regenerated is now captured on a schedule and sealed so that only the holder of the recovery key can open it.
The published head of that record is now sent to a machine outside the pool, so a change made to local history can be told apart from history itself.
Receipt durability: a receipt file created for the first time is now made durable together with the directory entry naming it. A power cut between the two could leave a receipt the system could not find.
Block quality: the pool now counts blocks it was handed with no transactions when the chain plainly had some. That situation was previously invisible.
Internal counters that only mean something to an operator are no longer published on the public status endpoint. They are shown in the operator view instead.
A miner opening its own statistics page no longer sees zero hashrate or an error. The page now answers with the figures it already had.
Block templates now carry a per-block fullness reading, so it is possible to see how complete the work being mined actually was.

v0.8.26.222026-08-16

The public website now reads each region's figures with a credential that can only read them. It had been carrying the same one the operator's own tools use, which is far broader than a website needs: that credential can also make changes, and it opens operator-only views where miner addresses appear unmasked. Nothing about the site's behaviour changes (the same pages show the same numbers), but the most exposed part of the pool no longer holds a key to the parts that aren't meant to be public. No effect on mining, share accounting, or payouts.
The public website now runs under its own account on the machine, separate from the mining engine it sits in front of. They had shared one, and the engine's private control channel is open to anything running under that account, including a channel that can ask the engine to stop taking connections. The website has never needed it and does not use it; it talks to the pool the same way anything else does. Sharing an account meant that if the website were ever broken into, the intruder would inherit reach it was never given on purpose. Now it cannot reach it at all. No effect on mining, share accounting, or payouts.
A single region falling behind can no longer pull a healthy one out of the published address. The pool watches each region from outside and compares what it is serving against what the others are, and with only two regions running, one lagging region was treated as settled fact rather than one opinion among several. On the 8th of August that is exactly what happened: a region briefly behind made the check condemn a region that was working perfectly, and it tried five times to withdraw it, stopped each time only by a rule that refuses to withdraw the last one standing. An independent, non-pool view of the chain had answered the whole time, agreed with the healthy region, and was being discarded. Below a real quorum, that outside view now has to agree before a region can be withdrawn, and a disagreement means no action at all rather than action on one unverified opinion. As more regions come online the quorum forms on its own and outranks the outside view again. No effect on mining, share accounting, or payouts.
A region withdrawn for its own health now comes back on its own. The pool remembered that it, rather than the operator, had taken a region out of the published address, but only for as long as the watching process stayed up. If that process restarted while a region was out, it came back assuming the operator had removed the region deliberately, and deliberate removals are never undone automatically. The region would have stayed out of the address permanently, waiting on a person, with nothing said. That memory now outlives a restart. The rule it protects is unchanged: a region an operator takes down by hand stays down, however healthy it looks. No effect on mining, share accounting, or payouts.
The pool's status check no longer reports how many submissions it discarded and why. Those counts are meant for the operator's own diagnostics, and one region had been serving them to anyone who asked. The same check now also states which region answered, so a wrong or slow response can be traced to its source without connecting to each site by hand, and it now survives the local process restarting instead of occasionally reading everything as healthy for a moment when it was not. No effect on mining, share accounting, or payouts.
The standalone tool miners can run to check their own payout receipts offline, without any other pool software installed, now rejects a malformed receipt cleanly instead of risking a read past the end of its own buffer while parsing one. Found by an internal security pass rather than in the field: every one of over five thousand real receipts pulled from the live journal still verifies exactly as it did before. No effect on mining, share accounting, or payouts.
If the Bitcoin node behind this pool goes down, work sent to miners could keep reading as fresh indefinitely: the same block template handed out again and again with nothing on the wire to say it had stopped changing. One of the pool's other chains already caught this case; the main Bitcoin path did not. It now does, and states it plainly on the pool's own status page. The pool still serves that work rather than refuse it outright: over the short window this is measured on, the network has almost always not moved on yet, and refusing on that alone would throw away good work far more often than it would ever catch bad work. No effect on mining, share accounting, or payouts.
Building a payout to enough recipients at once could, past a size no release has actually reached yet, send miners a work notification built from memory that was never written, instead of the real one. The pool now checks that before sending and refuses the job outright if it ever happens, the same way it already refuses any job it cannot build correctly. No effect on mining, share accounting, or payouts.
Your dashboard could show itself as disconnected, zero hashrate, no workers online, even while the pool underneath kept working normally. Two unrelated causes produced the same symptom. The page's own idle-time optimization had no time limit, so under real load it could wait indefinitely for a moment that never came and never open its connection; it now gives up on waiting after two seconds and connects anyway. And roughly once every five minutes, building the pool-wide activity summary at full scale could occupy the pool's control process long enough that an unrelated routine check missed its own deadline and read as a failure; that summary now yields between each rig instead of running start to finish in one stretch. No effect on mining, share accounting, or payouts.
You can now check a Glass Ledger receipt yourself, right on the landing page. Load one of the pool's own, or paste in one you were given, and its signature is checked against the published authority key entirely on your device: nothing is uploaded and no address is required. The page lays out the exact bytes the pool signs, coloured by what each one is, the digest those bytes produce, and the verdict underneath, and any single byte in the payload can be edited by hand to watch the digest and the verdict both change immediately. One changed byte breaking the entire signature is the whole point of a receipt like this, and now you can watch it happen instead of taking it on faith.
That same verifier now holds up against a file built to break it, not only a well-formed one. Twenty-three adversarial inputs were run against the real code rather than reasoned about from the outside, and most of it already held: injected markup comes back out as inert text, oversized fields never reach the display, deeply nested input does not exhaust the stack, and a mangled signature reports itself unverifiable rather than valid. Two things did not hold and are fixed. The literal text null crashed the page outright instead of reporting an unreadable receipt. And a very large file was read entirely into memory before the size limit meant to stop that was ever checked, so the limit only ever helped after the cost had already been paid.
The landing page's main headline used to stay invisible until the page's interactive code had fully loaded and run, even though reading it never actually depended on that code. It now appears as soon as the page's own styling arrives, measurably sooner, with everything below it still animating in exactly as before. Display only; no effect on mining, share accounting, or payouts.
On phones, the landing page's animated connections map used to start loading immediately on arrival, spending part of the first couple of seconds a phone is measured on to draw something sitting below content nobody has scrolled to yet. It now waits until the page has settled before it loads, and appears a couple of seconds later exactly where it always would have, once someone is actually looking. Desktop, where it was never competing for that time, is unchanged. Display only; no effect on mining, share accounting, or payouts.
Your Worker Statistics page for Bitcoin now shows your rig's own recent shares as a live rhythm underneath it: one mark per accepted share at its real difficulty, a marker standing on the newest one, its height tied to how that share actually compared against the network's own target rather than a fixed scale. Beside it, the same page doubles as a live view of the mempool your next block would be built from, coloured by what it actually costs to reach the front of the queue. On a fast rig that rhythm now groups recent shares instead of only ever keeping the newest handful, so it reads correctly at several shares a second instead of visibly resetting on every poll. Display only; no effect on mining, share accounting, or payouts.
The pool now has an About page, along with the brand media kit its logos and assets live in for anyone who wants to reference or link the pool elsewhere.

v0.8.26.142026-08-09

Submission replies: every submission the pool processes now gets an answer, including the ones it turns down. Until now, a submission refused by one of the pool's own limits (a submission-rate ceiling, or version bits outside the range your rig was allotted) received only a bare network acknowledgement: no acceptance, no rejection, no reason. From the rig's side that is indistinguishable from a pool working perfectly, so firmware that trips one of those paths on every submission can mine into nothing for hours while its own screen still reads normal. One rig did exactly that for thirty hours before anyone noticed, and it would have kept going. Every refusal now names its reason on the wire, so a rig, or you reading its log, can tell working apart from shouting into a void. Nothing that was credited before is credited differently, and nothing that was refused before is accepted now: the only change is that the pool stops going quiet.
Share accounting: your rejected count now means rejected. It had been carrying three different outcomes added together under one label: genuinely rejected work, work that arrived too late to count, and work below the difficulty you were assigned. An ordinary difficulty adjustment, which costs you nothing at all, read exactly like a real problem. Rejected, stale, and below-difficulty are now three separate figures, and the previous combined total is still published under a name of its own, so nothing you were already tracking disappears from under you. Presentation of existing numbers only; no share was counted differently before or after this change.
Hashrate accuracy: short-window hashrate figures no longer read low. The calculation divided your submitted work by a span measured from your first submission to your last, which is by definition shorter than the window being reported. With only a handful of submissions in view, that understated the result, and the fewer the submissions the worse it got. The span is now corrected for that gap. Figures during your first minutes on the pool deliberately still behave as before: while a window is filling, it should report the work actually seen rather than a projection of it. Display only; no effect on mining, share accounting, or payouts.
The live connections globe on the landing page now shows the whole pool instead of only Bitcoin. It drew Bitcoin's miners and network peers and nothing else, so a pool serving three chains looked like a pool serving one. Every chain is now on the one globe, each with its own colour and its own shape so no two layers can be mistaken for each other: Bitcoin in mint and amber, Bitcoin Cash in rose, Litecoin and Dogecoin in silver. The tally underneath adds up all of them rather than reporting Bitcoin's alone. Dogecoin deliberately has no layer of its own: it is mined on the very same connection as Litecoin, so drawing it separately would show rigs that do not exist. The pool's own sites are named on the globe now as well, Los Angeles and the second one in Chicago, with an arc drawn between them, so the path your work can take across the pool's regions is something you can see rather than something you have to be told. A site that cannot be reached simply doesn't appear; it never blanks the rest of the picture. Display only; no effect on mining, share accounting, or payouts.
Pool statistics: the worker counts and best-share figures on the pool leaderboards now count only rigs that are actually online. A rig you renamed, retired, or replaced left its old entry behind permanently, and those entries were still being folded into that address's totals. An address could appear with more workers than it runs, with a best share belonging to hardware that has been gone for months. The leaderboards now apply the same freshness window the rest of the statistics already used. Display only; no effect on mining, share accounting, or payouts.

v0.8.26.122026-08-07

A solved block can no longer be lost because a rig rolled version bits the pool did not allot it. Some firmware sends back the whole version field instead of only the portion it was given. The pool used to turn those submissions away before ever checking whether one had solved a block, so a genuine winner from such a rig would have been thrown away in silence. Those submissions are now rebuilt exactly as the rig hashed them and put through the block check like any other, but only after the pool confirms the resulting header is one the network would accept. A header that fails that confirmation is still refused rather than sent on, because publishing an invalid block would be worse than the problem being fixed. Such a submission still earns no share credit, exactly as before. The only change is that it can now win, and rigs that stay within their allotment, which is every rig this pool has seen, are unaffected.
Submissions the pool cannot read are now counted instead of vanishing. A malformed submission has always been answered with an error on the wire, but it left no trace in your statistics or in the operator's, so a misconfigured rig could mine into nothing and neither side could tell why from the pool's own numbers. Those now appear as rejected shares like any other rejection. The reply sent to the rig is byte for byte what it was, and nothing is credited that was not credited before. This only makes an invisible failure visible.
The Litecoin and Dogecoin connection endpoint now enforces the same per-address connection limits that the Bitcoin and Bitcoin Cash endpoints already had. It had been running with those limits switched off, which meant a single source could open unlimited connections and spend the pool's time answering them. Connected miners sit far below the limit and are unaffected. No effect on mining, share accounting, or payouts.
Your dashboard now warns you when a rig reports its voltage regulator running hot. The pool already received that reading and displayed it, but never compared it against anything, and on this class of hardware the regulator reaches its limit before the chip does. Watching chip temperature alone can miss it entirely. Rigs that do not report a regulator temperature are unaffected, and the pool still only advises: it never changes a rig's settings. Also corrected: the efficiency comparison against other rigs of the same model could flag a perfectly healthy rig when only two of that model were present, since two rigs have no meaningful middle to compare against. It now requires at least three. Display and advice only; no effect on mining, share accounting, or payouts.
Two Stratum V2 messages the pool declines to send are no longer dropped in silence. If an outgoing frame exceeded the size ceiling, or its header could not be serialized, the pool returned without sending and without a word, so from either end that was indistinguishable from the pool simply having nothing to say. Both now record the message type, its size and the connection before refusing. Neither is reachable by the traffic the pool builds today, which is precisely why they are worth recording: if either ever appears, it is news rather than noise. Both checks still run before any encryption, so a refusal never consumes an encryption counter and never leaves a connection out of step. No effect on mining, share accounting, or payouts.
A rig asking for a protocol or a version the pool does not serve now receives the specific error the standard defines, naming the reason, instead of a success reply it cannot act on. Before, such a connection was told everything was fine and then found that nothing worked, which left it retrying against a pool that looked healthy from the outside. This reaches only connections that were already going to fail; every rig currently mining negotiates normally and is untouched. No effect on mining, share accounting, or payouts.

v0.8.26.52026-08-03

New: a redesigned Worker Statistics and Pool Statistics experience for Bitcoin, organized around three time horizons: what's happening on the current block, rolling short-term windows, and your all-time record. Two new tools live inside it: an expected-time-to-block estimate built from your fleet's real measured hashrate and the network's current difficulty, and a 1-to-100 score showing how close your best-ever share came to solving a block, tracked per Bitcoin address, so it survives any single rig going offline. Pool Statistics gains its own leaderboards (top hashrates, best share, mining software, and a privacy-preserving geographic view), a live view of the most recent Bitcoin blocks, and a running Blocks Found count. Fully responsive across screen sizes. Display only; no effect on mining, share accounting, or payouts.
The redesigned dashboard is now available for Bitcoin Cash too, carrying that chain's own visual identity throughout.
Fixed: a brief connectivity hiccup while viewing your dashboard could make it silently fall back to the previous, older layout until your next successful refresh, instead of simply retrying and staying put. A failed check now only changes what's shown when there's genuinely nothing to display yet; once your data is on screen, it stays there. Display only; no effect on mining, share accounting, or payouts.
Fixed: the Sign Out button didn't fully end a session; a subsequent page load could silently restore it. Signing out now clears your session completely.
Stratum V2 extranonce uniqueness: two miners connecting over separate Stratum V2 connections could, in a narrow case, be handed the identical extranonce prefix and unknowingly search the same nonce range. Prefixes are now drawn from a single pool-wide sequence instead of one counter per connection, so every connected miner searches a distinct range. No effect on share accounting or payouts.
Block-submission integrity, rebuilt: the pool's internal check that a solved block matches what it committed to now recomputes the block's actual merkle root and compares it directly, instead of only counting transactions. This closes a narrow case where a body with the right transaction count but wrong contents could have passed unnoticed. And if that check ever does disagree with the pool's own block assembly, the block is no longer discarded on the spot: the pool logs the anomaly loudly and submits it anyway, leaving the Bitcoin network itself the final say on validity. No effect on mining, share accounting, or payouts under normal operation; this closes an edge case that has never fired in production.
Stratum V2 startup safety: the pool now checks its own certificate's validity window before opening its encrypted listener, and refuses to start rather than silently accept connections it can no longer authenticate correctly. This closes off a failure mode that would otherwise look healthy from the outside while every V2 miner failed to connect.
Security hardening: the pool now limits how many Stratum V2 connections may be mid-handshake at once, rejecting new ones past that limit before any cryptographic work is spent on them, protection against a connection flood or a fleet-wide reconnect storm exhausting the pool's resources. Ordinary reconnects sit far below the limit and are unaffected.
Reliability: if the pool's stratum port ever fails to open, for example because something else already holds it, the pool now logs exactly why instead of exiting without a trace, cutting diagnosis time for any future incident of this kind.
Block-submission integrity now covers every chain the pool serves, Bitcoin included: before a solved block reaches the network, the pool recomputes that block's actual merkle root from its own contents and compares it against the header it already committed to. If the two ever disagree, the pool logs the anomaly loudly and submits the block anyway: the network itself stays the only authority on whether a block is valid, and a false alarm from our own check must never be the reason a block is lost. No effect on mining, share accounting, or payouts.
Stratum V2 connection setup: a client asking for a protocol or a version the pool does not serve used to receive a success it could not act on, and would then wait for work that was never coming. It now receives the specific error the standard defines, so a misconfigured client fails immediately and says why. Every current mining client negotiates inside the supported range and is unaffected.
Stratum V2 protocol isolation: a message belonging to a protocol extension the pool has not negotiated is no longer executed as the core message that happens to share its number; it is refused and recorded instead. Unrecognized message types are now recorded as well, rather than dropped without a trace, so a client-side protocol mismatch can be diagnosed from the pool's side instead of looking like unexplained silence on both.
Job integrity: if the pool ever cannot express a job exactly, a merkle path or a coinbase larger than the protocol message is able to carry, it now refuses to send that job at all. Previously the oversized part was quietly trimmed, which would have left the miner hashing against a job that could never match the pool's own. Refusing is the safe outcome, and it is recorded rather than silent. Work in normal operation sits far inside these limits.
Block retention: the pool keeps a margin of recent work in memory so that a block solved against slightly older work can still be assembled and submitted. That margin used to be only a convention in the code; it is now enforced when the pool is built, so a future change cannot narrow it and quietly reintroduce a path where a solved block could not be rebuilt.

v0.8.262026-07-23

Litecoin with Dogecoin merged mining, working end to end for real rigs. Point a miner at the pool with the two-address username, your Litecoin payout address and your Dogecoin payout address together, and it now mines from the very first share, over both classic (V1) and modern, encrypted (V2) connections. Before, a valid submission from a rig using this format could be turned away before it was ever graded; the pool now accepts it and checks that one hash against both chains at once, so the same work can win a Litecoin block, a Dogecoin block, both, or neither, at no extra hashrate and 0% fee. Each chain's reward is paid on-chain straight to the address you gave for it; no effect on how a won block is found or paid.
Dogecoin merged mining is now visible inside the Litecoin dashboard and landing: pool-wide and per-address Dogecoin blocks found, the merged-mining proposition, and the Dogecoin block reward, with no separate site to visit. While the pool's Dogecoin node is still catching up to the network, the pages say so plainly instead of showing an ambiguous zero, and Litecoin mining is unaffected the whole time. Display and accounting only; no effect on mining or payouts, and Bitcoin and Bitcoin Cash are unchanged.
A distinct visual identity for the Bitcoin Cash landing page, carried through the entire page rather than just the top: the pool's live network, its miners and peers on the map, now anchors the page itself, with hashrate, workers online, and connection status read straight off it, and the difficulty comparison, the miner connection guide, and a one-line proof-of-custody pitch all carry the same look through to the page's own background. Presentation only; no effect on mining, share accounting, or payouts, and other chains' pages are unchanged.