Security & Custody

1. Exos never holds your funds

Exos is a non-custodial interface to Hyperliquid. Your collateral sits in Hyperliquid's validator-secured bridge and your positions live on the Hyperliquid L1. Exos has no deposit address of its own, no treasury that touches user funds, and no ability to move, freeze, or recover your balance. If Exos disappeared tomorrow, your account would be untouched: you could open app.hyperliquid.xyz with the same wallet and trade or withdraw everything directly.

2. What you approve, and what each approval can do

Trading through Exos uses three narrowly scoped permissions, and nothing else.

The trading session key is a temporary key generated in your browser and approved by one gasless signature. It can place and cancel orders for your account. It cannot withdraw, cannot transfer, cannot send funds anywhere, and cannot change your approvals. It is stored only on your device and you can revoke it at any time.

The builder fee approval authorises Hyperliquid to add Exos's fee (0.030% per routed order) to your trades, and caps it at the rate you approved. Exos cannot raise it beyond your approval. It is revocable at any time in Settings.

Everything that moves money (deposits, withdrawals, transfers to another account) is signed by your main wallet, every time. The session key is never able to perform these actions.

3. No Exos smart contracts

Exos deploys no smart contracts. Every order, fill, funding payment and liquidation is executed and settled by Hyperliquid's own on-chain systems. Your counterparty risk is Hyperliquid's, not ours, and it is the same whether you trade through Exos or through Hyperliquid directly.

4. Verify our fee on-chain

Exos's revenue is a builder fee attached to each order, settled transparently by the protocol. Our builder address is 0xF7ffbF230dd5656E8af7510E78dCC70b5Ad60150. Every fill routed through Exos, and the exact fee paid on it, is public on Hyperliquid. You do not have to trust our fee claims: you can check them.

5. What Exos stores

Exos never sees or stores private keys or seed phrases. The growth systems (points, referrals, leaderboards) store your wallet address and derived trading statistics, as described in the Privacy Policy. Your session key exists only in your own browser storage.

6. Reporting a security issue

If you believe you have found a vulnerability in Exos, please report it privately before any public disclosure. Contact: security contact to be published [TEAM: publish the security email and add it to lib/links.ts]. A formal bug bounty programme is planned after mainnet launch. Good-faith research is welcome; do not test against other users' accounts or funds.