---
title: "Two assets, compute leases, 45 security findings closed"
update: 2
week: 2026-w09
week_of: 2026-02-23
published: 2026-03-01
network: testnet
url: https://xe.marketized.io/changelog/2026-w09
---

# #002: Two assets, compute leases, 45 security findings closed

_23 Feb – 1 Mar 2026_

Accounts now hold XE and XUSD side by side, machines can be leased from other machines, and a full security review landed before anything else was built on top.

## XE and XUSD, on every account

**New** · Protocol

Every account tracks two assets, **XE** and **XUSD**, each with its own balance. Accounts open by claiming or receiving, with no genesis block to depend on.

[About the XE token](https://xe.marketized.io/token)

## Lease a machine from another machine

**New** · XE Machines

Three new block types, a lease, its acceptance and its settlement, turn compute into something one account can rent from another, priced by a formula every node agrees on.

[About XE Machines](https://xe.marketized.io/stack/gpu)

## 45 security findings, closed

**Security** · Protocol

A full review of the node before we built on it: tighter limits on everything a peer can send, votes that can’t be counted twice, and commits that can’t lose or double tokens if a node crashes.

## Improved

- **CLI & API:** Server-side proof of work over `POST /pow`, so light clients don’t have to compute it
- **Network:** Nodes keep their identity across restarts and retry bootstrap peers on their own

## Security

- **CLI & API:** The HTTP API listens on localhost by default, and an endpoint that exposed a key seed is gone
- **Network:** Size limits, timeouts and per-peer rate limits on the API, gossip and sync
- **Protocol:** Vote weights snapshotted when a conflict starts, so they can’t be changed mid-vote

## Fixed

- **XE Machines:** Lease durations round up, so a lease can never be underpaid
- **XE Machines:** A provider checks its capacity and balance before it offers a machine