Welcome to the November 2022 release of Harmonize. This 1.7 version brings many updates that we hope you'll enjoy. Here are some of the major new features:
For information about distribution and deployment of this version, see Distribution and deployment.
The next version will be the first release of Harmonize to have APIs removed after the depreciation period. We invite you to go to the versioning page to check that you would be ready for 1.8. We remain at your disposal to assist you.
We've added a new module allowing you to store your NFT collections on Harmonize securely. Whether it’s crypto punks, your customers' NFT cars, or other digital artworks, you now have the ability to admire and transfer them from our beloved web application.
To complete our Web 3 initiative, you can now connect Harmonize to dApps through WalletConnect. To help you with this, we've developed a new dedicated personal area, where you just have to choose an account and connect the dApp you want. You'll see, it is prodigiously easy to use it.
We have also started to work on a long, but necessary, project: the redesign of the user experience to submit and validate intents, both on the web and on the mobile apps. Our objective: to make the approvals more digestible, user friendly, and then, more secure!
This is what we achieved in this iteration. We hope you will enjoy it and we look forward to receiving your feedbacks.
The ability to act on all the specificities of the different blockchains can make governance complex for simple financial transfers.
This is why, we've created a new unique and intelligible intent to process a financial transfer that you can easily control with a unique approval workflow.
You choose a sender account, a recipient and an amount. And voilà! After that, we take care of transforming your transfer intent into the language of the target blockchain, be it for native currencies or tokens.
You can find all the details about this new feature in our documentation. N.B This feature is only available on the API for the moment and the web version is planned for 1.8.
Nowadays, there are multiple use-cases where you would have the need to sign an arbitrary payload with your account keys:
- For Web3 requirements,
- To use wallet proof as authentication token,
- To do some specific actions that Harmonize doesn't support (e.g Withdraw an airdrop, or after an hard fork).
For these reasons, we added a new type of intent that allows you to create a workflow with different levels of security (controlled and uncontrolled) and retrieve this information via the API.
You can find all the details about this new feature in our documentation. N.B This feature is only available on the API for the moment and the web version is planned for 1.8.
We have listened to your feedbacks and we have worked to ship Harmonize with a new Helm chart suite allowing you to deploy Harmonize with less configuration and with more capabilities (e.g multiple indexers/chains).
The old packaging will still be supported in version 1.7 and dropped for version 1.8. We remain available to assist you for migrating your deployment flow.
- Web app: you can now release from quarantine multiple transfers at once from the account page.
- Flows: you now have access to more context in the governance workflow conditions.
- API only: The
/intents/{intentId}/remaining-usersAPI operation has a new filter on user lock status. - API only: A new
/intents/dry-runAPI operation has been introduced to allow pre-validation of intent prior to submission, only a subset of intent types are currently supported on 1.7.0
Like all new minor releases of Harmonize, this version 1.7 will be rolled out (outside local working hours) in different phases:
- Integration environments: 14th November
- UAT environments: 16th November
- Production environments: 23th November
A downtime of less than 30 minutes should be expected.
Metaco actively supports and advocates for client based pentests to proactively identify and rectify vulnerabilities. A recent security audit identified a vulnerability in the authentication server that would enable a user that already has access to Metaco Harmonize to exploit API read-only access of other users who have proposed, approved or rejected an intent on Metaco Harmonize. If successfully exploited, read-only access can be gained to domains that they should not have access to in the same instance. To the best of our knowledge, this vulnerability has never been exploited. Metaco has taken immediate action to address the issue.
The vulnerability is assessed to be of LOW severity based on the standard CVSS (Common Vulnerability Scoring System) matrix, but Metaco treats it as MEDIUM as it could allow an unauthorized user to break some key segregation principles across domains.
- This vulnerability is only exploitable by users who already have access to the platform and with privileges to read intents (ie: a malicious user attack);
- The user can only escalate its privileges with intents existing in its current domain, possibly originating from a parent, but not from a sibling domain;
- An intent corresponding to the expected privilege escalation can only be used once (challenges cannot be replayed).
Successful exploitation of this vulnerability can only affect a user's read access to data belonging to other domains. The privilege escalation cannot be used to create/replay transaction requests, gain additional approval privileges, etc. on the Harmonize platform.
Harmonize up to version 1.7.24
Harmonize version 1.7.25 or above
Metaco recommends all on-prem clients update their Metaco Harmonize instance as soon as possible. Those leveraging the Metaco SaaS offering receive the fix automatically in the next maintenance window.