Free · F2
Relicensing risk and license stability
Can the provider unilaterally relicense future versions, and has it committed not to?
Why it matters
A permissive license today can become source-available tomorrow if a CLA assigns the rights. Past relicensing events are the best predictor.
Scoring anchors
| No CLA, or a CLA that does not permit unilateral relicensing, plus a written license-stability commitment in the repo. | |
| No CLA, no commitment. | |
| CLA permits relicensing; commitment exists in docs. | |
| CLA permits relicensing with no commitment, or a prior relicense event. | |
| No admissible evidence submitted yet. Counts as 0 in the pillar. |
Admissible evidence
- CLA file and CONTRIBUTING at a pinned commit verified
- Git history of the LICENSE file verified
Common failures
- CLA enforced by a bot configured outside the repo.
Current ratings
| Provider | Score | Finding |
|---|---|---|
| Aleo (credits.aleo private transfers) | There is no CLA and no written licence-stability commitment. The node and VM were relicensed from GPL to Apache-2.0 in May 2023, which widened rights but shows the maintainer can change the licence of future versions. Judgment call: anchor 0 names any prior relicense event; under the take-the-lower-anchor rule we score 0, though the change was permissive. | |
| AnomaPay | No CLA, no relicensing event, no written licence-stability commitment. | |
| Avalanche Card | No admissible evidence yet. | |
| Avici Card | No admissible evidence yet. | |
| Aztec (Alpha mainnet private token transfers) | There is no CLA and no licence-stability commitment. The monorepo's licence changed from GPL-2.0 to Apache-2.0 days after the repo was created, before any release. Judgment call: anchor 0 names any prior relicense event; this one was early and permissive, but under the take-the-lower-anchor rule we score 0. | |
| Bitget Wallet Card | No admissible evidence yet. | |
| Blanksquare (Shielder) | No CLA, no relicensing event and no written licence-stability commitment. | |
| COCA Card | No admissible evidence yet. | |
| Coinbase Commerce (Onchain Payment Protocol) | We found no CLA and no relicensing event. The repo makes no written commitment to keep the license stable. The UNLICENSED SPDX headers are an ambiguity, not a relicense, and are noted under F1. | |
| Curvy | No CLA and no licence-stability commitment. The licence files were added in commit 13d578d0 (2026-09-25); we did not check whether the code carried other terms before that. Scored 2. | |
| Daimo Pay | The repo has no CLA and we found no CLA bot. The license has never changed in substance. The repo makes no written commitment to keep the license stable. | |
| Deblock Card | No admissible evidence yet. | |
| Ethena Pay | No admissible evidence yet. | |
| ether.fi Cash | There is no CLA and no commitment, so 2 under the anchor. Judgment call: with no LICENSE at all, "relicensing" adds little risk on top of the F1 gap. I found no prior relicense event. | |
| Exa Card | There is no CLA, but there is also no license, so Exa Labs holds every right in its code and can license future versions however it likes. Judgment call: the anchors assume a license exists. "No CLA, no commitment" (2) would credit stability that an unlicensed repo does not have, so I took the lower anchor, 0. | |
| Fluidkey | No CLA and no licence-stability commitment. The kit's licence changed twice in January 2024, between two permissive licences. Judgment call: the anchor names any prior relicense as 0; we apply it as for Privacy Pools. | |
| Fuse Card | The program has already been relicensed, from BUSL to AGPL. That change opened it up, but it shows the licensor can relicense unilaterally. I found no CLA and no licence-stability commitment. Judgment call: the anchor names a prior relicensing event as 0, and I applied it even though the direction was toward openness. | |
| Gnosis Pay | Gnosis Pay's own repos have no CLA and no commitment (that alone would be 2). The Delay and Roles modifiers that gate every account are maintained under a Gnosis CLA that permits relicensing, and there is no license-stability commitment. Judgment call: I could not establish whether Gnosis Pay counts as a Gnosis affiliate under that CLA, so I took the lower anchor (0). Deployed mastercopies are immutable, so the risk applies to future versions only. | |
| HesabPay | No admissible evidence yet. | |
| Hinkal | No CLA and no licence-stability commitment. The contracts have been BUSL-1.1 in this repository from the start, so we found no relicensing event. Scored 2. The licence is already source-available, which F1 covers. | |
| Holyheld Card | No CLA and no commitment; the license has not changed since the first commit. That is the anchor for 2. It scores relicensing risk only; the license itself is BUSL (see F1). | |
| Houdini Swap | No admissible evidence yet. | |
| Hyperbeat Card | No admissible evidence yet. | |
| Jupiter Card | No admissible evidence yet. | |
| M-Pesa | No admissible evidence yet. | |
| MetaMask Card | A CLA permits relicensing, and the LICENSE itself reserves future licensing choices instead of committing to stability. That meets anchor 0. | |
| Opera MiniPay | No admissible evidence yet. | |
| Monero | There is no CLA, copyright stays with each contributor, and the repo's contribution contract forbids copyright assignment, so no single party can relicense the code. No relicensing has happened. Judgment call: we read the no-assignment and share-alike rules as the written licence-stability commitment anchor 3 asks for. | |
| Nullmask | No admissible evidence yet. | |
| Oobit Card | No admissible evidence yet. | |
| Payy Card | The repo was MIT until March 2026, when an internal sync removed the LICENSE and left the code unlicensed. That is a prior relicensing event, so 0. MIT grants on code published before c4d2c902 still stand. | |
| Phantom Cash | No admissible evidence yet. | |
| Plasma One | No admissible evidence yet. | |
| Privacy Pools (0xbow) | No CLA and no licence-stability commitment. The core repo was relicensed from MIT to Apache-2.0 before mainnet launch, both permissive. Judgment call: the anchor names any prior relicense event as 0; this one did not restrict users, but we follow the anchor and take the lower score. | |
| Railgun | No CLA, no relicensing event in the SDKs, and no licence-stability commitment. The contracts and circuits have never been licensed, which F1 records. Scored 2. | |
| Request Network | There is no CLA, and the MIT licence has not changed since 2018. The repo makes no written commitment to keep the licence stable. | |
| Rizon Card | No admissible evidence yet. | |
| SafePal Card | No admissible evidence yet. | |
| Solayer Card (Emerald Card / Solayer Pay) | No admissible evidence yet. | |
| Tongo (confidential ERC-20 on Starknet) | No CLA and no relicensing event; no written licence-stability commitment. | |
| Tornado Cash (Classic pools) | There is no CLA and no relicensing event, and the GitHub repos are archived. No written licence-stability commitment exists. | |
| Tria | No admissible evidence yet. | |
| Tuyo Card | No admissible evidence yet. | |
| Umbra Cash | No CLA and no relicensing; no written licence-stability commitment. Scored 2. | |
| Wirex One | No admissible evidence yet. | |
| Wise | No admissible evidence yet. | |
| WORM (BETH proof-of-burn) | No CLA and no relicensing event; no written licence-stability commitment. | |
| XPlace Card | No admissible evidence yet. | |
| Zcash (shielded transfers) | The required node and protocol libraries have no CLA. There have been two relicensing events: orchard moved from the Bootstrap Open Source License to MIT or Apache-2.0 in 2023, which widened rights, and the Zodl Android SDK moved from MIT to AGPL-3.0-only in August 2026 under a CLA that lets Znewco sell commercial licences. No licence-stability commitment exists. Judgment call: anchor 0 names any prior relicense event; the Zodl change concerns an optional wallet SDK and the orchard change was permissive, but under the take-the-lower-anchor rule we score 0. | |
| zERC20 (zBNB on BNB Chain) | The official repository is not public, so its CLA, contributing rules and licence history cannot be checked. The snapshot's LICENSE sets a 2030 change date to GPL-2.0-or-later. |