Introduction

Spec 437 is the next mainnet runtime after v431. It is headlined by miner registration collateral — a subnet can lock a share of its floating registration price as a bond on the registering hotkey instead of burning all of it — plus on-chain hotkey and coldkey swap lineage so validators and indexers can follow identity across renames without an archive node. The release also carries the operational work shipped on the way here: pure proxies operable by a multisig from the CLI, one-call stake transfer to a new coldkey and hotkey, a dedicated stake-transfer minimum, air-gapped transaction signing with Polkadot Vault, and benchmark-measured weights for every extrinsic in the runtime.

Miner collateral

Registration on a collateral subnet splits the floating price in two. The burned share is recycled exactly as before — the spam throttle is unchanged. The locked share is staked to the registering hotkey and held as collateral, and each tempo the chain releases k × emission of it back to withdrawable stake (miner incentive and validator dividends). Earning emission is the only exit. The lock survives deregistration and is credited when the same hotkey re-registers, so a pruned miner returns for roughly the burned share alone; a hotkey that stops earning emission keeps its remainder frozen indefinitely.

A hotkey's bond over its career, at a 10α registration price with a 90% lock share. The lock declines as emission is earned and is fully released once lifetime earnings reach bond ÷ k. If validators blacklist a mining hotkey — off chain, by simply not scoring it — incentive stops, the release stops with it (unless the hotkey still earns validator dividends), and the remainder strands.

The design in one line: the burn prices the registration event; the collateral prices what a miner does afterward. A pure burn cannot punish post-registration behavior — by the time a score-gaming miner is caught, its payoff is banked and a fresh hotkey costs only the next burn. With collateral, an adversary who plans to farm emissions and abandon the hotkey must out-earn the full registration price against a work-gated refund. Sybils, UID squatters, and blacklisted hotkeys never release their locks at all. Honest miners are nearly unaffected: they recover the bond by doing exactly the work they registered to do, and their sunk cost stays the burned share. An interactive model of the bond — drag the lock share, drain ratio, and earning rate, and toggle the blacklist scenario — is in the collateral guide.

Two miner extrinsics extend the mechanism to deposit-style policies. add_collateral voluntarily locks more on your own hotkey (free stake first, then buys any shortfall with TAO) — for example to meet a validator-published per-machine requirement on resource subnets — and set_min_collateral sets a self-maintaining floor: the drain never releases below it, and while the lock is under it, earned emission is captured into the lock until the floor is met, so miners don't re-lock drained funds every tempo. Collateral is a first-class metagraph field: every neuron row carries collateral_locked, collateral_min, and collateral_earned (lifetime emission since the bond existed), so validator enforcement costs zero extra calls. Full get_metagraph consumers with frozen SCALE types must refresh metadata for v437 — the three vectors are appended at the end of the struct; selective fetches of the previous indices are unchanged. The SDK surfaces the same path as bt.AddCollateral / bt.SetMinCollateral and client.collateral.* (miner_collateral, subnet_collateral, collateral_policy); the CLI mirrors it with btcli collateral (show / list / add / set-min) and the matching btcli query / btcli tx entries.

Using it in your subnet

Collateral is off by default — the lock share ships at zero, which is byte-for-byte the previous chain behavior. Owners opt in with two hyperparameters, settable through btcli sudo set (owner-or-root, rate-limited, outside the weights window):

btcli sudo set --netuid 42 --name collateral_lock_share --value 0.75   # p = 75%
btcli sudo set --netuid 42 --name collateral_drain_ratio --value 1.0    # k = 1

collateral_lock_share (p) decides how much of the entry price is accountability rather than toll; collateral_drain_ratio (k) decides how long a good miner takes to work it off. Break-even emissions before a ban are E* = max(T ÷ (1 + k), (1 − p)·T) — the familiar T ÷ (1 + k) form applies when p ≥ k ÷ (1 + k); otherwise the bond drains before break-even and the floor is just the burned share (1 − p)·T. Three starting points:

1. Standard bond (p = 75%, k = 1) — general-purpose deterrence: sybils and UID squatters forfeit, honest miners recover at par.
2. Anti-tail-risk (p = 83–90%, k = 0.2–0.5) — for subnets whose scoring can be gamed on short horizons (trading, forecasting): a large lock with a slow drain keeps your fastest apparent earners collateralized through your detection window.
3. Fast release (p = 67%, k = 2) — a capital gate at entry with minimal ongoing lockup, for lower-stakes work.

Example · trading-signals subnet

Miners submit equity trades; validators score a rolling Sortino ratio. The metric is blind to tail risk: a martingale that quietly sells crash insurance posts a top-percentile score for months, farms emissions, then blows up. Under pure burn (price τ10) the farmer nets ~τ70 a cycle and just re-registers a fresh hotkey. Set collateral_lock_share = 90% and collateral_drain_ratio = 0.2:

btcli sudo set --netuid 42 --name collateral_lock_share --value 0.9    # p = 90%
btcli sudo set --netuid 42 --name collateral_drain_ratio --value 0.2    # k = 0.2

Same registration price on both sides. Pure burn lets the farmer forget for the next burn alone. With p = 90% and k = 0.2 the τ9 lock is still mostly intact when validators stop scoring after the blow-up, so the remainder strands. Break-even before detection is E* = T ÷ (1 + k) ≈ τ8.3.

Registration still costs the same floating τ10 — now τ1 burned, τ9 swapped into locked alpha. Here p = 90% ≥ k/(1+k) ≈ 17%, so break-even is E* = T ÷ (1 + k) ≈ τ8.3 in emissions before your validators stop scoring the hotkey, and the slow drain keeps ~τ9 at risk deep into the run. An honest miner with a real edge is barely affected: τ1 sunk, and the τ9 lock releases steadily as they earn. The subnet never had to fix Sortino; it just made the tail risk expensive to hide.

The payoff curve makes the deflection concrete. Net profit per register-farm-banned cycle is E + min(k·E, p·T) − T with the bond versus E − X for a pure burn — where E is emissions farmed before the ban and T is the TAO registration price. Setting profit to zero yields E* = max(T ÷ (1 + k), (1 − p)·T):

Illustrative preset: burned share X = τ100, lock share p = 83% (sticker price T = X ÷ (1 − p) ≈ τ600), drain k = 0.5. Since p ≥ k/(1+k), E* = T ÷ (1 + k) = τ400 — four times the pure-burn bar of τ100. If the drain has not yet released the bond by the time the ban lands, the remainder is forfeit on top.

Example · Lium GPU marketplace

Resource subnets like Lium need more than a registration bond: each machine a miner brings should be backed by a deposit, pulling a rented machine should forfeit it, and an honest departure should wind down cleanly. The chain stays amount-agnostic; the per-machine policy lives in validator code. Owner config is a modest registration bond plus a deposit-friendly drain:

btcli sudo set --netuid 51 --name collateral_lock_share --value 0.5    # p = 50%
btcli sudo set --netuid 51 --name collateral_drain_ratio --value 1.0    # k = 1

Publish the rule off chain as 25α of collateral per machine, and have miners fund it with the two deposit extrinsics. Four machines means a 100α floor:

btcli collateral add --netuid 51 --amount-alpha 100 -w my_coldkey -H my_hotkey
btcli collateral set-min --netuid 51 --min-alpha 100 -w my_coldkey -H my_hotkey

Four GPUs × 25α = 100α required. add_collateral funds the lock; set_min_collateral parks the floor so the drain cannot undercut the deposit. Clear the floor and keep serving rentals to wind down; pull a rented machine and the score goes to zero, freezing whatever is left.

Validators enforce coverage from the metagraph alone. Every neuron row already carries collateral_locked, collateral_min, and collateral_earned, so under-collateralized hotkeys get zero weight and no new rentals. An exiting miner clears the floor, finishes existing jobs while still scored, and the ordinary drain returns the deposit. Pulling mid-rental strands it. Full owner, miner, and validator code for both this pattern and the trading example is in the collateral guide.

Two properties make collateral safe to adopt on any subnet. Both parameters are snapshot per miner at registration, so changing them never re-prices standing locks. Enforcement needs no ban extrinsic: validators stop scoring a hotkey, stake-weighted by construction and reversible if they resume. Key scoring state by hotkey, not UID, and persist it across deregistrations so a track record cannot be laundered by cycling registration.

Air-gapped signing with Polkadot Vault

Every transaction can now be signed from a Polkadot Vault phone — a device that never goes online. Pass --signer vault and the CLI shows the transaction as a QR code; the phone decodes the call on its own screen, you approve it there, and the signature travels back through your webcam. No keyfile, password, or mnemonic ever exists on the machine running btcli. Like Ledger signing, the flow is clear-signing through merkleized metadata, and setup is a single chain-specs scan with no metadata updates to sync — ever, including across runtime upgrades. The same signer is available in Python as bt.VaultSigner.

The signing key never touches an online machine. btcli builds the unsigned transaction and renders it as a QR code; the offline Vault phone decodes and clear-signs it on its own screen; the signature QR returns through the webcam, and the chain verifies the same merkleized-metadata digest the phone displayed.

Pure proxies, multisig-operated

The strongest key setup the chain supports is a pure proxy controlled by a multisig: the operating account — a subnet owner key, a treasury — is keyless, so there is no seed to steal, its address never changes, and the signer set behind it can be rotated freely. The chain has always allowed the composition; the tooling now does too. --proxy-for composes with --multisig on btcli call, so a signer set can dispatch any call as the pure account:

btcli call SubtensorModule.set_sn_owner_hotkey --args '{...}' \
  --proxy-for my-subnet-owner --multisig my-team -w alice

Each signatory approves the same wrapped call — matched by hash, as with any multisig operation. The first approval prints ready-to-run commands for the co-signers, and btcli multisig pendingreconstructs them on any machine by decoding the proxy wrapper from the on-chain call data, so co-signers need none of the submitter's local state. --proxy-for alone (without a multisig) now also works on btcli call, matching the flag every btcli tx command already carries.

Stake transfers, generalized

transfer_stake_and_hotkey hands a stake position to another coldkey and lands it on a different hotkey — optionally on a different subnet — in one atomic extrinsic. Previously this took two calls (transfer_stake then move_stake), with the position exposed on the wrong validator between them and the second call left to the recipient. Pass --dest-hotkey to btcli tx transfer-stake (or dest_hotkey_ss58 on the TransferStake intent) and the SDK dispatches the new call. Stake transfers also get their own minimum: InitialMinTransfer is 0.0001 TAO, where transfers previously had to clear the 0.002 TAO staking minimum.

Weights, measured

Every dispatchable in the runtime now carries a benchmarked weight — including proof_size, which was previously ignored — replacing the hand-assigned constants used before. The benchmark suite was rebuilt around worst-case state, and a CI lint now fails any PR that adds an extrinsic without a plugged-in benchmark. Fees follow weights, so per-call fees shift slightly in both directions; nothing changes by an order of magnitude. Alongside: the chain's Rust source is browsable at bittensor.com/code exactly as built into the running runtime, extension signing reuses remembered accounts without re-prompting, and URLs in CLI output are clickable in supporting terminals.

Key lineage

After a successful hotkey or coldkey swap, the chain records identity continuity so watchers can ban or attribute by a stable root without replaying archives.

Hotkey lineage is per-subnet (a swap may move a UID on one netuid while the old hotkey stays registered elsewhere):

• HotkeySuccessor(netuid, old) → new — the rename edge
• HotkeyRoot(netuid, hotkey) → root — first key in the chain (absent means the key is its own root)

hotkey_root(netuid, hotkey) -> AccountId
same_hotkey_lineage(netuid, a, b) -> bool
hotkey_lineage_tip(netuid, hotkey) -> AccountId   // best-effort; prefer root for bans

Dissolution clears these maps. Re-registration of a previously swapped-away SS58 clears a stale outgoing successor. Bonded miners may rename with keep_stake=false (the bond migrates with the UID); keep_stake=true while any MinerCollateral remains fails with KeepStakeBlockedByCollateral— there is no validator-permit escape.

Coldkey lineage is global (a coldkey swap moves ownership everywhere at once):

• ColdkeySuccessor(old) → new
• ColdkeyRoot(coldkey) → root

coldkey_root(coldkey) -> AccountId
same_coldkey_lineage(a, b) -> bool
coldkey_lineage_tip(coldkey) -> AccountId   // best-effort; prefer root for attribution

Written at the end of a successful do_swap_coldkey, inside the same storage transaction that migrates stake, ownership, locks, and miner collateral. Prefer root for owner-keyed policy; tip walks are advisory under key reuse.

What to do

Operators should wait for the on-chain spec_versionto move to 437, then upgrade nodes and clients. SDK users should pull the matching bittensor release once the train publishes it — older clients keep working, they simply don't know the new calls. Nothing changes for miners on subnets that keep the default collateral settings; on subnets that opt in, check the split before registering with btcli query burn and btcli sudo get --name collateral_lock_share.

Indexers should add SubtensorModule.transfer_stake_and_hotkey (call index 143), SubtensorModule.add_collateral (144), SubtensorModule.set_min_collateral (145), AdminUtils.sudo_set_collateral_lock_share (call index 98), AdminUtils.sudo_set_collateral_drain_ratio (call index 99), the StakeAndHotkeyTransferred, CollateralLocked, and MinCollateralSet events, the MinerCollateral storage map, and the key-lineage maps HotkeySuccessor / HotkeyRoot / ColdkeySuccessor / ColdkeyRoot. Validators that ban by SS58 should prefer hotkey_root (and coldkey_root for owner attribution) over raw addresses; treat tip helpers as advisory.

Signers: after the release train proposes, use btcli upgrade sign --url <v437 release URL> -w <wallet>.