Program Upgrade 0.1.10

TL;DR: program 0.1.10 inserts required accounts into six instructions. That is a positional wire break in both directions, so a single SDK build cannot be sent to both programs unchanged. SDK >= 2.7.0 builds 0.1.10-style and, for the three affected instructions it actually uses, removes the inserted account again while the target program still runs 0.1.9. The switch is a per-program-id timestamp baked into the SDK — no RPC call, no caching. Upgrade the SDK any time before the flip with zero code changes.

Deployments

Use getConfig("staging") (or "staging-mainnet-clone" for a production-like bank set) to test against 0.1.10 today.

What changes in the program

• Per-bank oracle circuit breaker — a bank whose price moves more than a configured threshold in a window temporarily halts risk-increasing operations (borrow, withdraw, liquidate). New OperationalState.CircuitBroken bank state, which the SDK parses instead of throwing.
• Same-asset e-mode — banks sharing a mint and oracle family (e.g. Kamino SOL, JupLend SOL, P0 SOL) can be placed in same-asset e-mode for higher leverage. New SameAssetEmodeRegistry account per group.
• Configurable fees — per-liability-bank liquidation fees and a configurable account-transfer fee in FeeState.
• Account resizes — MarginfiGroup grows 1,056 → 9,248 bytes and FeeState 256 → 512 bytes (reserved padding, layouts are prefix-identical). Expect a short outage right after the mainnet deploy while accounts are resized.
• Oracle fix — Switchboard feeds no longer use std_dev; oracle_max_confidence configures a static confidence spread instead.

Full details: UPGRADE-0.1.10.md in the SDK repo.

The breaking change: inserted accounts

Solana instructions carry accounts as an ordered, unnamed array. Inserting a required account mid-list shifts every later index, so the six instructions below break in both directions (old layout → new program and new layout → old program):

Everything else survives: deposit / withdraw / borrow / repay / account create & close are unchanged, account decoding works across versions (layouts are prefix-identical), and admin instructions that only gained trailing Option args are tolerated by 0.1.9.

How the SDK handles it

SDK 2.7.0–2.7.3 carried a per-program-id timestamp switch (MARGINFI_V0_1_10_ACTIVATION / isMarginfiV0110Live) so one build could talk to both programs around the flip: makeEndFlashLoanIx, makePulseHealthIx and makeAccountTransferToNewAccountIx built the 0.1.10 layout and spliced the inserted account out while the target program still ran 0.1.9. The switch was removed in 2.7.4 once the upgrade was final; the SDK now emits the 0.1.10 layout unconditionally, and those exports no longer exist.

What you must do

Using the SDK's builders (Layers 2–4):

1. Upgrade to @0dotxyz/p0-ts-sdk@^2.7.0 before 2026-08-25 15:00 UTC. No code changes.
2. Optionally test against getConfig("staging"), which already runs 0.1.10.

Hand-rolling any of the six instructions (raw program.methods.*() calls, the /instructions subpath, or your own Borsh encoding) — the SDK cannot intercept those:

• Add the inserted account at the positions in the table above, and gate on isMarginfiV0110Live(programId) if you need to keep sending to 0.1.9 until the flip.
• end_liquidation gains an optional trailing fee_payer writable signer; when omitted, liquidation_receiver pays the flat fee as before.
• Don't send 0.1.9-encoded admin instructions to 0.1.10: shorter args make the new program read garbage for the appended options.

Decoding accounts yourself: nothing breaks — but a Bank in CircuitBroken state only decodes with the 0.1.10 IDL bundled in SDK >= 2.7.0.

Troubleshooting