Security

Who signs what

When you press Buy or Sell, the server reads the chain — market, balances, allowance, a live quote — and composes the transaction. It never signs. Your Privy embedded wallet, created for you at sign-in, signs and sends it in your browser. We request no delegation, no session signer and no server-side key for user wallets. There is no code path by which the backend can move a user's funds.

The wallet a trade uses is always the signed-in user's own, taken from the session — you can only trade your own funds.

What a trade may touch

The recipient of a prepared transaction is only ever one of these routers, Permit2, or the token being approved. Nothing else, ever.

• Uniswap SwapRouter02· v3 swaps0xcaf681a66d020601342297493863e78c959e5cb2
• Uniswap Universal Router· v4 swaps (any hook)0x8876789976decbfcbbbe364623c63652db8c0904
• Uniswap V2 Router02· the few v2 pools0x89e5db8b5aa49aa85ac63f691524311aeb649eba
• Permit2· token approvals for the Universal Router0x000000000022d473030f116ddee9f6b43ac78ba3

Quotes are read-only calls to Uniswap QuoterV2 (0x33e885ed0ec9bf04ecfb19341582aadcb4c8a9e7) and Uniswap v4 Quoter (0x8dc178efb8111bb0973dd9d722ebeff267c98f94); they sign nothing.

Baked into every swap

• Slippage-bounded minimum out. Every leg carries a floor derived from the live quote and your slippage setting; a no-confirmation click cannot be sandwiched to zero.
• Two-step routes re-read the receipt. A token quoted in USDG or a tokenised stock trades in two transactions; the amount for the second is read from the first receipt's Transfer log, never trusted from the client.
• Gas headroom is checked before a send, so a trade cannot strand the wallet without gas for the sell.
• The route is shown in words before you trade: the trade box names the path (for example ETH → USDG → NVDA → LDC) and how many transactions it takes.

The signals bot's wallet

The live copy book trades from a wallet that belongs to hoodini, not to any user. No user wallet, key or balance is involved in it at any point, in either direction. The paper book — which is what the signals page shows unless a row says live — sends nothing and holds nothing on chain.

Accounts and data

Sign-in is Privy (an email or a wallet); we store the session, your trade settings, your demo and real trade records, and rate-limit by IP. Analytics are Google Analytics 4 and Cloudflare Web Analytics; neither is given a wallet, a trade or an account identifier. Details on the legal page.

Reporting a problem

Message @hoodiniapp on X. The machine-readable pointer is /.well-known/security.txt.