Security posture

Defense model

The security design starts from a simple partition: custody is code, trading is mandate. Everything that could move value out of a vault is either impossible by construction (the agent's action set) or gated on-chain (manager standing, payout addressing, queue resolution).

Key structural choices:

• The trading agent's key is provisioned by the protocol, held server-side, and scoped to an order-only action set. The manager never sees it.
• The order gate re-validates everything on-chain per request and rejects raw payloads outright.
• NAV counts only what can be proven on-chain, with cost-basis caps on anything self-reportable and a curated set of HIP-3 dex venues (spot is an open, USDC-quoted universe valued at min(market, cost)).
• No admin keys can touch vault funds; fee splits are immutable in the implementation.
• Bot API keys are stored only as SHA-256 hashes (plaintext shown once at mint), are order-only, and never grant standing on their own — every request re-checks manager standing on-chain, so revoking a key or rotating the manager both cut access immediately.

Verification status

• Five adversarial red-team rounds converged: every confirmed critical was a NAV over-statement vector, all closed structurally (most by deleting the machinery that made them possible, not by patching).
• The full contract and gate test suites run green; the trading surface is exercised end-to-end against live Hyperliquid HyperCore state.
• The contracts are live on Hyperliquid mainnet, running as a gated private beta. An external human audit is pending — none has been completed, and we won't claim otherwise. Invariant/fuzz testing ("NAV never exceeds real backing") accompanies it. Treat smart-contract risk as real when sizing a deposit.

The internal audit dossier and attack-surface inventory are maintained in the repository and will be published alongside the audit.