437Release

Collateral & Key Lineage

What shipped

Spec version 437 is the next mainnet runtime after 431. Its headline is miner registration collateral: a subnet can lock a share of its floating registration price as a bond on the registering hotkey instead of burning all of it. Alongside that come on-chain hotkey and coldkey swap lineage, so validators and indexers can follow an identity across renames without an archive node, and the operational work shipped on the way: pure proxies operable by a multisig from the command line, one-call stake transfer to a new coldkey and hotkey, a dedicated stake-transfer minimum, air-gapped transaction signing with a Polkadot Vault phone, and benchmark-measured costs for every extrinsic in the runtime. The source for this page is one document: the project's own release note, titled "Collateral & Key Lineage" and dated July 2026. It is an interested party's account of its own work — so what follows reports what that note says rather than repeating it as established fact. [source] [source] [source]

Registration on a collateral subnet splits the floating price in two. The burned share is recycled exactly as before, so the spam throttle is unchanged; the locked share is staked to the registering hotkey and held as collateral. Each tempo the chain releases a multiple of that hotkey's emission back into withdrawable stake, where the multiple is a subnet-level setting. Earning emission is the only exit. The lock survives deregistration and is credited when the same hotkey re-registers, so a pruned miner returns for roughly the burned share alone — and a hotkey that stops earning emission keeps its remainder frozen indefinitely. [source] [source]

The release puts the design in one line: the burn prices the registration event, and the collateral prices what a miner does afterward. Its argument is that a pure burn cannot punish post-registration behaviour, because by the time a score-gaming miner is caught its payoff is banked and a fresh hotkey costs only the next burn — whereas with a bond, an adversary who plans to farm emissions and abandon the hotkey has to out-earn the full registration price against a work-gated refund. Sybils, slot squatters and blacklisted hotkeys, on that account, never release their locks at all, while an honest miner recovers the bond by doing the work it registered to do and keeps the burned share as its only sunk cost. [source]

None of this turns on by itself. Collateral ships off by default — the lock share is zero, which the release describes as byte-for-byte the previous chain behaviour — and a subnet owner opts in through two hyperparameters set with btcli sudo set. [source]

What it changes for the ecosystem

For miners this is the release behind the split entry cost lesson 11 describes. On a subnet that keeps the defaults, nothing changes at all. On one that opts in, part of the price you pay is no longer spent — it is a bond attached to your hotkey, released only as you earn, and the release's own instruction is to check the split before registering, with btcli query burn for the price and btcli sudo get --name collateral_lock_share for the share that gets locked. Losing a slot does not cost you the bond either — the behaviour that lesson already sets out: it survives deregistration and is credited back on re-registration, so a pruned miner re-enters for roughly the burned share. [source] [source]

The catch is the exit condition, and it is worth stating in the release's own terms. The lock is released against emission earned, so a hotkey that stops earning keeps its remainder frozen. The release is explicit that this is how enforcement is meant to work: if validators blacklist a mining hotkey — off chain, by simply not scoring it — incentive stops, the release of the lock stops with it — unless that hotkey still earns validator dividends — and the remainder strands. That is exactly the off-chain enforcement path lesson 12 described. [source] [source]

For subnet owners this is a new dial with real reach into who bothers to register. The two settings decide how much of the entry price is accountability rather than toll, and how long a good miner takes to work it off; the release publishes three starting points — a general-purpose standard bond, a large-lock slow-drain preset for subnets whose scoring can be gamed on short horizons, and a fast-release preset that is mostly a capital gate at entry. Two properties are what make it safe to adopt, on the release's account: both parameters are snapshot per miner at registration, so changing them never re-prices standing locks, and enforcement needs no ban extrinsic at all. Its accompanying advice to owners is to key scoring state by hotkey rather than by slot and to persist it across deregistrations, so a track record cannot be laundered by cycling registration. [source] [source] [source] [source] [source]

Validators get the enforcement side for free, because collateral is a first-class metagraph field: every neuron row carries what is locked, the self-imposed floor, and lifetime emission earned since the bond existed, so checking coverage costs no extra calls. The release's own worked pattern for a resource subnet — its example is the Lium GPU marketplace — is that the chain stays amount-agnostic while the per-machine policy lives in validator code: publish the rule off chain, have miners fund it with the two deposit calls, and give an under-collateralized hotkey zero score. There is a cost of entry for tooling, though — anything consuming the full metagraph with frozen SCALE types has to refresh metadata for 437, since the three new vectors are appended to the end of the struct. [source] [source] [source]

The key-lineage half of the release is aimed at anyone who has ever tried to ban or attribute by address. After a successful hotkey or coldkey swap the chain now records identity continuity itself, so a watcher can resolve a key to a stable root without replaying archives — hotkey lineage per subnet, because a swap may move a slot on one network while the old hotkey stays registered elsewhere, and coldkey lineage globally, because a coldkey swap moves ownership everywhere at once. The release's instruction to validators who ban by address is to prefer the lineage root, and to treat the "tip" helpers as advisory only. Collateral and lineage meet in one place worth knowing: a bonded miner may rename, and the bond migrates with the slot, but a rename that tries to keep stake behind while collateral remains is rejected outright. [source] [source] [source] [source] [source]

The operational changes land mostly on people who hold serious keys. What the release calls the strongest key setup the chain supports — a pure proxy controlled by a multisig, where the operating account is keyless so there is no seed to steal, its address never changes, and the signer set behind it can be rotated freely — has always been possible on chain; as of 437 the tooling composes it, so a signer set can dispatch any call as the pure account, and a co-signer can reconstruct the pending approval from on-chain call data without any of the submitter's local state. Every transaction can now also be signed from a Polkadot Vault phone that never goes online, with the call shown as a QR code and the signature returned through a webcam, so no keyfile, password or mnemonic exists on the machine running the command line. Handing a position to someone else gets one call instead of two: stake moves to another coldkey and lands on a different hotkey, optionally on a different subnet, atomically — where previously the position sat exposed on the wrong validator between the two calls. [source] [source] [source] [source]

Everyone else's list is short. Fees move slightly, because every dispatchable now carries a measured cost from a rebuilt benchmark suite rather than a hand-assigned constant — in both directions, and the release says nothing changes by an order of magnitude. Operators wait for the on-chain spec_version to move to 437 before upgrading nodes and clients, and older clients keep working; they simply do not know the new calls. Indexers add the new stake-transfer, collateral and admin call indices, the new events, the collateral storage map, and the four lineage maps. [source] [source] [source]

What to watch

The release is careful about one thing the chain does not need here: enforcement takes no ban extrinsic at all. It is validators declining to score a hotkey, which the release describes as stake-weighted by construction and reversible if they resume. The worked numbers it publishes are presented as illustrative presets rather than measurements, and the parameters behind them are per-subnet choices. [source] [source]

Unverified What that leaves open is who is actually protected. The mechanism strands a bond by withholding a score, and withholding a score requires no justification, no evidence and no appeal — the same act that starves a genuine attacker starves a miner whose work a validator set simply does not want to pay. On a subnet with noisy or contested scoring, an honest bond can strand exactly as an adversary's does, and the release's claim that honest miners are nearly unaffected holds only for as long as they keep earning. The note describes no other lever either — no slashing, no on-chain judgement of a miner — but a release note is not an exhaustive inventory of the runtime, so that is an absence in this document rather than an established property of the chain.
Unverified The second open question is adoption. Because the lock share ships at zero, 437 changes nothing anywhere until individual subnet owners turn it on, and a higher entry bond is a cost a miner can avoid by registering somewhere else. Nothing in this document says how many subnets intend to opt in, or what a bond does to the number of miners who show up — which is the number that decides whether the subnet got safer or just quieter.
How it actually works

The bond

Registration on a collateral subnet splits the floating price: the burned share is recycled as before, and the locked share is staked to the registering hotkey as collateral. Each tempo the chain releases k × emission of it back to withdrawable stake, counting both miner incentive and validator dividends. The lock survives deregistration and is credited when the same hotkey re-registers. [source]

Two hyperparameters govern it, both owner-or-root, rate-limited, and settable outside the weights window: [source] [source]

btcli sudo set --netuid 42 --name collateral_lock_share  --value 0.75   # p = 75%
btcli sudo set --netuid 42 --name collateral_drain_ratio --value 1.0    # k = 1

collateral_lock_share (p) decides how much of the entry price is accountability rather than toll; collateral_drain_ratio (k) decides how long a good miner takes to work it off. Break-even emissions before a ban are E* = max(T ÷ (1 + k), (1 − p)·T) — the familiar T ÷ (1 + k) form applies when p ≥ k ÷ (1 + k), and otherwise the bond drains before break-even and the floor is just the burned share. The release publishes three starting points: [source]

The payoff curve behind those numbers: net profit per register-farm-banned cycle is E + min(k·E, p·T) − T with the bond, against E − X for a pure burn, where E is emissions farmed before the ban and T the registration price. Setting profit to zero yields the same E*. The release's illustrative preset — burned share of τ100, p = 83% for a sticker price of about τ600, and k = 0.5 — puts E* at τ400, four times the pure-burn bar, with any undrained remainder forfeit on top. [source] [source]

Worked example: a trading-signals subnet

The release's scenario is miners submitting equity trades scored on a rolling Sortino ratio — a metric it describes as blind to tail risk, so a martingale quietly selling crash insurance posts a top-percentile score for months, farms emissions, then blows up. Under pure burn at a τ10 price, it puts the farmer's take at about τ70 a cycle before re-registering a fresh hotkey. The suggested settings: [source] [source]

btcli sudo set --netuid 42 --name collateral_lock_share  --value 0.9   # p = 90%
btcli sudo set --netuid 42 --name collateral_drain_ratio --value 0.2   # k = 0.2

Registration still costs the same floating τ10, now τ1 burned and τ9 swapped into locked alpha. Because p = 90% clears k/(1+k) ≈ 17%, break-even is T ÷ (1 + k) ≈ τ8.3 in emissions before validators stop scoring the hotkey, and the slow drain keeps roughly τ9 at risk deep into the run. The release's summary of the effect: the subnet never had to fix Sortino, it just made the tail risk expensive to hide. [source] [source]

Worked example: the Lium GPU marketplace

For resource subnets like Lium, the release's pattern is a modest registration bond plus a deposit-friendly drain, with the per-machine rule published off chain and funded by the miner: [source] [source] [source] [source]

btcli sudo set --netuid 51 --name collateral_lock_share  --value 0.5   # p = 50%
btcli sudo set --netuid 51 --name collateral_drain_ratio --value 1.0   # k = 1

btcli collateral add     --netuid 51 --amount-alpha 100 -w my_coldkey -H my_hotkey
btcli collateral set-min --netuid 51 --min-alpha 100    -w my_coldkey -H my_hotkey

At a published rule of 25α per machine, four machines means a 100α floor: add_collateral funds the lock and set_min_collateral parks the floor so the drain cannot undercut the deposit. An exiting miner clears the floor, finishes existing jobs while still scored, and gets the deposit back through the ordinary drain; pulling a rented machine mid-rental drops the score to zero and freezes whatever is left. [source] [source]

The two miner extrinsics, and the metagraph fields

add_collateral voluntarily locks more on your own hotkey, taking free stake first and buying any shortfall with TAO — for example to meet a validator-published per-machine requirement. set_min_collateral sets a self-maintaining floor: the drain never releases below it, and while the lock is under it, earned emission is captured into the lock until the floor is met, so miners do not re-lock drained funds every tempo. Every neuron row carries collateral_locked, collateral_min and collateral_earned (lifetime emission since the bond existed), so validator enforcement costs zero extra calls. Full get_metagraph consumers with frozen SCALE types must refresh metadata for v437 — the three vectors are appended at the end of the struct, and selective fetches of the previous indices are unchanged. The SDK exposes bt.AddCollateral / bt.SetMinCollateral and client.collateral.*, and the CLI mirrors it with btcli collateral (show / list / add / set-min). [source]

Key lineage

Hotkey lineage is per-subnet, because a swap may move a UID on one netuid while the old hotkey stays registered elsewhere: HotkeySuccessor(netuid, old) → new is the rename edge, and HotkeyRoot(netuid, hotkey) → root the first key in the chain, absent when the key is its own root. The runtime exposes hotkey_root(netuid, hotkey), same_hotkey_lineage(netuid, a, b) and a best-effort hotkey_lineage_tip(netuid, hotkey) — the release says to prefer the root for bans. [source] [source] [source] [source] [source]

Coldkey lineage is global, since a coldkey swap moves ownership everywhere at once: ColdkeySuccessor(old) → new and ColdkeyRoot(coldkey) → root, with coldkey_root, same_coldkey_lineage and an advisory coldkey_lineage_tip. These are written at the end of a successful do_swap_coldkey, inside the same storage transaction that migrates stake, ownership, locks and miner collateral; the release's guidance is to prefer the root for owner-keyed policy and to treat tip walks as advisory under key reuse. [source] [source] [source] [source] [source]

Dissolution clears these maps, and re-registration of a previously swapped-away SS58 clears a stale outgoing successor. Bonded miners may rename with keep_stake=false, in which case the bond migrates with the UID; keep_stake=true while any MinerCollateral remains fails with KeepStakeBlockedByCollateral, and there is no validator-permit escape from that. [source]

Signing, proxies, and transfers

Air-gapped signing runs through --signer vault: btcli renders the unsigned transaction as a QR code, the offline Vault phone decodes and clear-signs it on its own screen, and the signature QR returns through the webcam, with the chain verifying the same merkleized-metadata digest the phone displayed. Setup is a single chain-specs scan with no metadata updates to sync, including across runtime upgrades, and the same signer is available in Python as bt.VaultSigner. [source] [source]

--proxy-for now composes with --multisig on btcli call, so a signer set can dispatch any call as a keyless pure account: [source] [source]

btcli call SubtensorModule.set_sn_owner_hotkey --args '{...}' \
  --proxy-for my-subnet-owner --multisig my-team -w alice

Each signatory approves the same wrapped call, matched by hash. The first approval prints ready-to-run commands for the co-signers, and btcli multisig pending reconstructs them on any machine by decoding the proxy wrapper from the on-chain call data, so co-signers need none of the submitter's local state. --proxy-for alone now also works on btcli call, matching the flag every btcli tx command already carries. [source]

transfer_stake_and_hotkey hands a stake position to another coldkey and lands it on a different hotkey — optionally on a different subnet — in one atomic extrinsic, where this previously took transfer_stake then move_stake with the position exposed on the wrong validator in between and the second call left to the recipient. Pass --dest-hotkey to btcli tx transfer-stake, or dest_hotkey_ss58 on the TransferStake intent. Stake transfers also get their own minimum: InitialMinTransfer is 0.0001 TAO, where transfers previously had to clear the 0.002 TAO staking minimum. [source]

Weights, measured

Every dispatchable in the runtime now carries a benchmarked weight — including proof_size, previously ignored — replacing the hand-assigned constants used before. The release says the benchmark suite was rebuilt around worst-case state, and that a CI lint fails any pull request that adds an extrinsic without a plugged-in benchmark. Fees follow weights, so per-call fees shift slightly in both directions, with nothing changing by an order of magnitude. Shipped alongside: the chain's Rust source is browsable exactly as built into the running runtime, extension signing reuses remembered accounts without re-prompting, and URLs in CLI output are clickable in supporting terminals. [source]

What to do

Operators wait for the on-chain spec_version to move to 437, then upgrade nodes and clients; SDK users pull the matching bittensor release once the train publishes it, and older clients keep working without knowing the new calls. Nothing changes for miners on subnets that keep the default collateral settings; on subnets that opt in, check the split before registering with btcli query burn and btcli sudo get --name collateral_lock_share. [source]

Indexers add SubtensorModule.transfer_stake_and_hotkey (143), add_collateral (144) and set_min_collateral (145); AdminUtils.sudo_set_collateral_lock_share (98) and sudo_set_collateral_drain_ratio (99); the StakeAndHotkeyTransferred, CollateralLocked and MinCollateralSet events; the MinerCollateral storage map; and the lineage maps HotkeySuccessor / HotkeyRoot / ColdkeySuccessor / ColdkeyRoot. Validators that ban by SS58 should prefer hotkey_root, and coldkey_root for owner attribution, over raw addresses. Signers use btcli upgrade sign --url <v437 release URL> -w <wallet> after the release train proposes. [source] [source]