How to check a trading bot before funding it

The short answer

Put six questions to it, and fund nothing until each has a readable answer. Then fund an account with only what you are ready to lose.

1. Who holds the keys, and what the one that can withdraw is doing.
2. What the program can sign, as a closed list.
3. Where the limits live, and who enforces them.
4. What it has settled in simulation, with real fees and real funding.
5. What each replay could see when it decided.
6. What a round trip costs, the program's own cost included.

Who holds the keys

If funding it means sending coins to someone else's address, or pasting a secret phrase, that is the whole answer already. On Hyperliquid there is a middle way: an account approves an API wallet, an agent key, which signs for it and holds no funds at all.

Here the account's own key stays in your wallet: in Locker Vault, on an offline phone, signing by QR code, the safest, or in the extension or mobile wallet you chose. The agent key is sealed on disk under a password you choose and held in memory by a guardian for the hours you unlock, eight by default. Whoever asks for an order never sees it.

What it can sign

Ask for the list, not a reassurance. A key able to withdraw will withdraw if it is stolen, whatever the program around it intends.

The guardian signs placing, changing and cancelling orders, and a market's leverage and margin. Nothing else. Measured on mainnet on 28 September 2026, the key itself was refused every withdrawal, every send, the move between spot and perps, a second agent and a builder fee. One movement was accepted, depositing the account into a Hyperliquid vault, and it is not on the guardian's list.

The limits, and who holds them

A limits file the program can edit is not a limit. Ask where the bounds live, what happens when something widens them, and whether an old file restores an old permission.

This computer's limits are a file: the largest order, the leverage, the dexes and the markets, the orders a day. Tightening holds at once; widening waits for your password at the next unlock, because the guardian keeps the limits it was unlocked with.

Above it sits the mandate: the same bounds signed by your wallet, for the agent key's life at most (180 days), with a ceiling on the notional opened per day. The guardian applies the narrower of the two, and the folder remembers the highest mandate signed and any revocation, marks that only go up: a deleted file, an older one put back, or a revoked one opens nothing. Closing is always allowed.

A record, and replays without hindsight

Ask how many trades actually settled, and refuse a win rate given without a lower bound. A backtest that reads a candle's close to decide at its open describes a market that never existed.

The simulation account fills on Hyperliquid's live book, pays the venue's fees and our service fee, is charged the hourly funding, and is liquidated like a real cross account. A replay report gives the win rate with its 95% lower bound and the costs under three slippage scenarios, and a strategy short of settled trades is called not proven.

The pilot's replays run the same day function a real day runs, with each moment's dossier cut at that instant: the candles stop there, the calendar is that week's only, the headlines are dated before it, and the open interest, of which the exchange keeps no history, is said absent rather than guessed.

What it costs, counted before the order

A method that wins in simulation and loses on costs is the common case. Ask for the fees of both legs, the funding over the days a position waits, the slippage, and, for anything that calls a model, its dollars.

Each is counted here before an order is sent, and a trade whose costs eat the gain it aims at is refused. The model's price is a required setting: with no price, its cost cannot be counted and the trade is refused rather than guessed, and the model's share of the target is capped at 10%.