Release notes
This is an important security update that fixes vulnerabilities identified during our recent security audit.
Updating to this version is required to continue trading. BSQ Swaps have also been re-enabled.
Security
- DAO block signatures: DAO blocks received from the network can now be signed by trusted BSQ block providers. Bisq verifies these signatures before accepting the blocks.
- Blind-vote validation: Bisq rejects blind votes whose encrypted payload does not match the on-chain commitment, and decrypts vote results only from the ballots that match the majority hash.
- Dispute-opening validation: New dispute cases are validated before being accepted. Disputes that fail validation are rejected.
- Arbitrator-witness signatures: Signed witness records are now checked for valid DSA signatures before being used for account aging.
- Seed-only data filtering: Network data that is intended to come only from seed nodes is now rejected when received from non-seed peers.
- Price-zero offer rejection: Offers with a price of zero are rejected and not added to the offer book.
- Burning Man fee routing: The Burning Man distribution address list is now used when selecting BTC fee receivers.
- Trusted seeds: Trusted seed nodes are used during network bootstrap.
Other changes
- Alert authors can remove all alerts they created.
- Legacy arbitrator data has been removed from trade and deposit flows.
Installation
macOS
Bisq does not use Apple's notarization process (see why).
For that reason you will see that (misleading) alert:
Grant permissions by:
- run sudo xattr -rd com.apple.quarantine /Applications/Bisq.app in a terminal (type Terminal in the Apple search box)
- open Bisq again
More details can be found here.
Windows
For similar reasons you will get that warning at Windows: Windows protected your PC
- Click the More info button when prompted
- Click the Run anyway button when prompted
More details can be found here.
Verify download
See the verification and installation instructions in the Bisq Wiki.
