BasicSwap v0.17.6 is a maintenance and hardening release from July 2026. It hardens the network against offer-revoke spam, replaces the fixed login timeout with sessions that follow your activity, and finally brings transaction history to Electrum light wallets, alongside a batch of swap-reliability fixes and a sturdier AMM.

There are no coin-core updates and no database migration this time, so the upgrade is a light one. You can get it by updating your BasicSwap client to the latest version, and full instructions are at the bottom of this post.

Most Notable Updates 💡

Offer-Revoke Hardening 🛡️

When a maker cancels an offer, their node broadcasts a small revoke message over the messaging network so everyone else can drop the offer from their books. Anyone can send such a message, which makes it a surface for spam, and v0.17.6 tightens it at both ends (PR #625).

On the receiving side, your node now does the cheap checks first and the expensive work last. A revoke aimed at an offer that is provably too old to still exist is discarded the moment it arrives, before it costs the node any database work, since offers live at most 48 hours. A revoke for an offer your node has not seen yet is only kept if its signature checks out, so junk revokes can no longer crowd real ones out of the waiting queue. And repeats of the same revoke are recognised and dropped, so a flood of copies no longer fills your log with noise.

On the sending side, your node now refuses to broadcast revokes for offers that are missing, expired, or inactive, so well-behaved nodes stop contributing pointless traffic of their own.

These are anti-spam changes, not fund-safety ones; the swap protocol itself is untouched. If you have seen revoke-related log spam recently, this update is what stops it.

Login Sessions That Follow Your Activity 🔐

If you protect your web UI with a password, you have probably run into the old timeout. Exactly 60 minutes after logging in you were sent back to the login screen, even mid-click, because the timer was fixed and no amount of activity would extend it.

v0.17.6 replaces that with activity-based sessions (PR #608). While you are using the UI, a lightweight heartbeat keeps your session alive, and once you walk away it expires after an idle timeout, which now defaults to 15 minutes and can be set anywhere from one minute to a week.

The settings page gains a Security tab to go with it. You can now enable, change, or disable the web-UI password and set the session timeout from the GUI, with no need to edit basicswap.json by hand. As a safety measure, disabling the password stays blocked while allowed_hosts is set to "*", so you cannot strip both layers of protection at once by accident.

Login also remembers where you were, so after re-authenticating you land back on the page you came from rather than on the offers page. The AMM no longer needs your password on disk either. When the GUI starts the market maker it now hands it a temporary token rather than writing your password into the AMM config file, so the manual auth field on the AMM page is gone. Standalone createoffers.py users can still set credentials in the config as before.

A Smarter Lock Screen 🔓

The login and wallet-unlock screens were rebuilt on a shared template, and both picked up quality-of-life upgrades (PR #605, PR #622). A status indicator now shows whether your BasicSwap node is reachable, and the form holds a login attempt back rather than firing it at an offline server and failing cryptically. A wrong password no longer reloads the page. Instead you get an inline error, the field clears, and you can try again immediately. The login screen also picks up the caps-lock warning, the show-password toggle, and the proper mobile scaling the unlock screen already had.

Transaction History for Electrum Wallets 📜

Until now, running Bitcoin or Litecoin in Electrum light-wallet mode meant your wallet page showed no transaction history at all. v0.17.6 fixes that, and Electrum-backed wallets now list their history the way full-node wallets do (PR #613).

The history loads a page at a time as well. Rather than pulling a wallet's entire transaction list just to render one page, BasicSwap now fetches details only for the page you are viewing and briefly caches the rest, so flipping between pages stays fast (PR #612).

Wallet history also gained type filters. You can narrow the list to swap transactions, or to MWEB, blind and anon, or Spark transactions on the coins that have them (Litecoin, Particl and Firo respectively).

Swap Reliability Fixes ⚙️

A failed adaptor-signature swap in which nothing was ever locked on the second chain is now cleanly closed out. Such a swap used to linger in the in-progress list indefinitely, re-checked on every pass without ever resolving, because the recovery logic was waiting on a lock transaction that did not exist (PR #621). In the same spirit, Monero's "not enough money" error is now treated as a passing condition, since it usually means funds are briefly locked or unconfirmed, so the swap retries instead of failing hard (PR #614).

Wallet handling got steadier too. Starting up with only part of your wallets unlocked no longer confuses the UI into thinking the whole system is unlocked (PR #611), and Litecoin's wallet unlock now shares Bitcoin's code path, including the MWEB wallet, which removes a spot where the two could drift apart (PR #624). An Electrum wallet that is locked, still starting up, or briefly unresponsive also no longer has its deposit address regenerated by mistake. Before, BasicSwap read a wallet it could not query as one that did not own the address, and rotated it. Now it waits until the wallet can answer (PR #609). Wownero picked up the same wallet-opening shortcut Monero already had (PR #619).

Standing Offers and Automation 🤖

Standing offers with a wallet floor no longer bog down the node. The balance check behind the floor used to run against every matching offer ever posted, including expired ones, and on coins like Monero, where each balance lookup briefly ties up the wallet, a node with hundreds of accumulated offers could fall behind and delay other work such as accepting bids. The check now looks only at live offers and asks each coin for its balance once per pass (PR #617, PR #618).

The max_concurrent_bids cap is now respected on reverse-ads offers as well. Accepted bids of that kind were not being counted against it, so automation could take on more simultaneous swaps than you configured (PR #623).

AMM: Templates Tracked by ID 🏷️

AMM offer and bid templates used to be tracked by name, which meant renaming one silently orphaned its runtime state, such as its sold-amount budget and its record of active offers. Templates now carry a stable internal id, existing configs are migrated automatically, and ids are generated for any template missing one, so renaming is safe (PR #616).

The AMM also stops showing the "inactive" pill on a template that has an active offer, and a bug that broke running createoffers.py on its own, outside the GUI, was fixed (PR #606). The AMM is now at version 0.5.2.

Smaller Fixes 🧹

A latent bug in the shared amount formatter could produce wrong decimal digits when a value was displayed at a different precision than it is stored at, so an amount like 1.2345 would have rendered as 1.6789. No current screen exercised that path, which makes this a proactive fix, and it is now pinned down with tests (68fc059).

The release also adds test coverage for the offer-revoke changes, covering sending, receiving, expiry guards, signature validation and deduplication, and for the AMM's new id tracking.

Install the Latest BasicSwap Update 🖥️

To install, update BasicSwap through the usual process and relaunch.

Docker

If you've installed BasicSwap following the Docker method:

1. Shutdown BasicSwap properly and stop the Docker image (docker-compose stop),
2. From the basicswap folder, type the git pull command,
3. In the /docker folder, run the docker-compose build --no-cache command,
4. Once the process completes, launch BasicSwap again using the docker-compose up command.

Note: Depending on your Docker version, adding a dash between docker and compose may not be necessary and may instead throw an error.

Non-Docker

If you've installed BasicSwap following the non-Docker method:

1. Shutdown BasicSwap properly,
2. From the ~/coinswaps/basicswap folder, type the git pull command,
3. Execute the following command: source ~/coinswaps/venv/bin/activate
4. Execute the following command: pip install --require-hashes -r requirements.txt,
5. Execute the following command: pip3 install .,
6. Launch BasicSwap as usual.

Install Script

If you've installed BasicSwap using Nahuhh's GitHub installation script:

• Execute the update command: bsx-update.

Changelog 📝

The full changelog for v0.17.6, grouped by area. It covers 17 pull requests, from #605 to #625, plus direct commits.

Offer-Revoke Hardening

• Don't broadcast revokes for missing, expired, or inactive offers [b60c71f] / PR #625
• Drop incoming revokes for provably expired offer ids before any database access [0a71012] / PR #625
• Verify revoke signatures before storing revokes for unknown offers, and grow the pending queue [0a71012] [dbe8cb7] / PR #625
• Skip repeated database reads for revokes on expired offers, log a pending revoke only once per offer, and log the sending address of invalid-signature revokes [d4661b0] [dbe8cb7] [277a85c] / PR #625

Client Auth and Login

• Rebuild the login page on the unlock screen's template [5313e58] / PR #605
• Redirect back to the previous page after login [46bf969] / PR #608
• Add a session heartbeat so activity extends the session instead of a fixed timeout [883c6d5] / PR #608
• Add client auth and session timeout to the settings UI [9988b02] / PR #608
• Use a temporary token for the GUI-started AMM instead of storing the password in plaintext, and remove the auth field from the AMM page [8de1037] [b1aa251] / PR #608
• Show server status on the lock screens and don't send login attempts to an offline server [a6f6c2f] / PR #622
• Show bad-login errors inline without a page reload [e049b1b] / PR #622

Wallets and Electrum

• Show transaction history for Electrum wallets, with swap and MWEB/blind/anon/Spark filtering [f3ec415] [291d768] / PR #613
• Fetch Electrum transaction details per history page, chunk batch requests, and cache history metadata for pagination [6d2d0f9] / PR #612
• Skip deposit-address regeneration when wallet ownership cannot be verified [11ed8b7] / PR #609
• Use Bitcoin's unlockWallet for Litecoin, with a shared seed unlock for MWEB to avoid drift [c134a03] / PR #624

Offers and Automation

• Only check balance floors on live, sent standing offers [071a208] / PR #617
• Query each coin's spendable balance once per floor-check pass instead of once per offer [2ad9522] / PR #618
• Don't try to recover a coin-B lock that doesn't exist; cleanly remove such failed swaps from the in-progress list [e2ccacc] / PR #621
• Respect max_concurrent_bids on accepted reverse-ads offers [856430b] / PR #623

AMM

• Track templates by id instead of name, migrate existing configs, and generate ids where missing [a955857] / PR #616
• Fix createoffers.py standalone usage broken by the basicswap package import [a9b22b8] / PR #606

Fixes

• Startup: report the system as locked after a partial unlock [12623c9] / PR #611
• Monero: treat "not enough money" as a transient error [3df965f] / PR #614
• Wownero: inherit Monero's openWallet optimisation [d2d9847] / PR #619
• Fix format_amount when the display precision differs from the stored precision [68fc059]

Tests

• Offer-revoke send/receive tests: expiry guards, signature validation, and deduplication [b100ce4] / PR #625
• AMM id-tracking state tests [afbe38a] / PR #616

You can inspect all changes by verifying the v0.17.5 to v0.17.6 comparison page here.

Stay Connected

Keep up with BasicSwap on social media:

• Twitter: @basicswapdex
• Matrix: BasicSwap channel
• GitHub: BasicSwap repositories
• Support the project: Donation page