Hyperliquid trading wallets

Each strategy with perps trades from its own wallet on Hyperliquid. The vault contracts cannot reach funds on Hyperliquid directly, so this wallet's controls matter. This page explains who controls the wallet, what it can and cannot sign, and what happens if one party is unavailable.

Key points

• Each strategy with perps trades from its own wallet on Hyperliquid. The wallet is held with Privy, a wallet service. It is owned by a 2-of-2 key quorum: the creator and a dedicated Tango key must both sign, and neither can sign alone.
• A Privy policy limits what the wallet can sign. It can trade, approve Tango's exact builder fee, and send USDC back to the strategy's own sub-account on Base. Everything else is denied, including transfers elsewhere and exporting the key.
• Tango only co-signs actions it planned and checked, and the app re-checks each one before the creator approves it.

Which wallets are involved?

A 2-of-2 quorum means two keys own the wallet and both must approve before it signs anything. The NAV attester posts the Hyperliquid account's value onchain, and the NAV provider is the contract that receives it.

Setup creates the trading wallet before the vault is deployed. Its address is written into the vault's approved bridge transaction (its call shape) as the only recipient.

Two signatures for every action

Every action on Hyperliquid needs a signature from the creator and a signature from Tango. Each side checks the action independently before it signs.

Creator in Manage -> Tango API: asks for an action (open, close, adjust margin, send back)
Tango API: plans the exact Hyperliquid action and records it, with a short window to approve it
App on the creator's device: recomputes the typed data and checks the market, leverage, builder fee and destination
Creator: approves the exact request with their Privy authorization signature
Tango API: re-checks the wallet's owners and policy, and for risk-adding steps the market and trading switches
Tango API: adds its authorization signature; Privy signs only with both, and only within the policy
Hyperliquid: receives the signed action

1. The creator asks for an action in Manage. Tango's API reads the account, plans the exact Hyperliquid actions and records each one. The creator then has a short window to approve them.

2. Before the creator approves, the app recomputes on the device what will be signed from the action itself, and requires the two to match. It checks that:

   • the market is one the strategy chose;
   • leverage is isolated and within the ceiling;
   • the builder fee is Tango's exact fee;
   • margin moves stay within the account;
   • any transfer goes only to this strategy's Hyperliquid Account.

3. The creator approves by signing a Privy authorization over that exact request.

4. Tango co-signs only requests it planned and recorded, and only typed-data signatures for this wallet. Typed data is a structured message that the signer can read. Before signing, Tango confirms that the wallet:

   • is still owned by exactly the 2-of-2 quorum;
   • has no extra signers;
   • has one policy;
   • was never exported.

   For anything that adds risk, Tango also re-checks the strategy's chosen markets and Tango's trading switches. It then checks that the signature recovers to the trading wallet, meaning the trading wallet produced it, and submits it once.

On Base, the creator signs alone. Tango builds and checks those transactions, but it never signs them.

The policy

A policy is a set of rules that Privy checks before the wallet signs. Every signature the trading wallet produces must pass its Privy policy. The same 2-of-2 quorum owns the policy, so changing it also needs both signatures.

Why can't the policy check every order?

Hyperliquid exchange actions are hashed before they are signed, so Privy cannot inspect individual order fields. Three other checks keep these actions to the strategy's markets and limits: Tango's planner, the app's check before the creator approves, and Tango's re-check before it co-signs.

Actions that move money work differently. They are signed as readable typed data, so Privy enforces their recipients directly.

Who can do what alone?

Even with both signatures, USDC on Hyperliquid can only leave towards the strategy's own Hyperliquid Account on Base. From there, it can only go back into the vault.

Automatic trading

A creator who connects an AI agent can opt in to automatic perps trading for one strategy, where it is available. Turning it on takes two approvals, and the creator and Tango both sign each one:

1. A policy change that keeps every existing rule and adds one exact rule allowing a single trading agent.
2. Registering that agent with Hyperliquid.

Tango's execution service holds the agent wallet. The agent can place, cancel and modify orders, update leverage and margin, and move collateral within the account. It cannot sign withdrawals or any other transfer. Tango's backend narrows it further, to the markets, leverage and slippage frozen in the creator's permission.

With automatic trading on, Tango's execution service can trade the strategy's Hyperliquid account without a per-order approval from the creator, within those limits. Stopping automatic trading turns off Tango's signing for the agent. Each new permission uses a fresh agent wallet.

What if something is unavailable?

These are the trust assumptions of trading on an offchain venue. They are part of the reason strategies with perps settle deposits and withdrawals instead of allowing instant ones. See Perps on Hyperliquid.