Security
How real trading on KestrelPerps is secured, what the session key can and cannot do, and where the real risk sits.
This page describes real trading at /trade. The demo terminal at /demo holds no real money and is not covered by anything below. Read this page before you sign anything.
Non-custodial
KestrelPerps never holds your funds. There is no deposit address that belongs to us, no omnibus account, no internal ledger of what you own. Collateral is USD-denominated and sits in your own trading account. We route orders and we take a fee on routed volume. That is the whole relationship.
Our fee is 1 basis point, 0.01%, on routed volume. The protocol ceiling is 0.1% and we sit at a tenth of it. You approve a 0.05% maximum once, which leaves headroom so the fee can be adjusted inside that band without asking you to sign again. It cannot go above the maximum you approved.
The one payment address we do publish is the treasury used for on-chain payments such as demo top-ups and new demo markets: 0x130dF20141beB7DB58E8bc8481755328fd3A093b on Robinhood Chain. Nothing sent there is trading collateral, and nothing there is custody of a real position.
The two signatures
You sign exactly two things, once, at the start of a session:
- Authorisation of a trading session key.
- Authorisation of our fee, at the 0.05% maximum described above.
After those two signatures, orders are signed locally by the session key. There is no wallet popup per trade. This is why the terminal can feel like a normal exchange rather than a wallet prompt on every click.
The session key
The session key is a keypair generated in your browser. The private half is created locally, stays in your browser, and is never sent to a server. We do not have it, we cannot recover it, and we cannot reissue it for you. What your wallet signs is an authorisation naming the key's public address, not the secret itself.
| Action | Session key |
|---|---|
| Place an order | Can |
| Modify an order | Can |
| Close a position | Can |
| Move funds to a vault or sub-account | Can |
| Withdraw to an external address | Cannot |
| Send funds to another wallet | Cannot |
| Change the approved fee maximum | Cannot |
Withdrawal always requires a signature from your own wallet. The session key cannot produce it.
The honest caveat
The inability to withdraw limits where funds can go. It does not limit how much you can lose. Treat the session key as a live key over your balance, because that is what it is. The 24 hour expiry and the one-click revocation exist precisely because of this, not as a convenience feature.
- The session key expires automatically 24 hours after it is authorised.
- You can revoke it at any time, from the terminal, in one click.
- Revoking is instant and does not close your positions. Positions and collateral stay where they are.
- After a revocation or an expiry, you sign again to start a new session with a new key.
Revoke whenever you finish trading for the day, whenever you step away from a shared or public machine, and immediately if anything about the session looks wrong: an order you did not place, a position size you did not choose, a transfer to a vault you did not make.
If you lose a device
A lost or stolen laptop or phone may still hold a session key that has not expired. Assume it does.
- From any other device, connect the same wallet and revoke the active session key.
- Check open positions and open orders. Close or reduce anything you did not intend to be carrying.
- Withdraw collateral to your own wallet if you want it out of reach while you sort the device out.
- Start a fresh session only on a device you control.
If the wallet itself was on the lost device, the session key is the smaller problem. Move funds to a wallet whose keys are not on that device, using the wallet's own recovery process, then revoke.
Phishing
- We do not send direct messages first. Support that contacts you unprompted is not us.
- We never ask you to connect a wallet on a site linked from a message.
- Check the domain in the address bar before signing, every time. A phishing page can copy this one exactly.
- Read what you are signing. Two signatures at the start of a session is what is expected. A third prompt, or a prompt asking for a token approval or a transfer, is not part of this product.
- Bookmark the terminal and use the bookmark instead of search results or links.
What we can and cannot do for you
We can revoke nothing on your behalf, recover nothing you have lost, and reverse no order that was signed with a valid key. Non-custodial cuts both ways: no one can take your funds from us, because we do not have them, and no one can give them back to you either.
What we can do is keep the signing surface small. Two signatures, one short-lived key, a hard limit on withdrawal, an approved fee ceiling, and a revoke button that works immediately.
wallet key -> withdrawals, authorisations (never leaves your wallet)
session key -> orders, positions, internal moves (browser only, 24h, revocable)
KestrelPerps -> routing and a 0.01% fee (no custody, no keys)Reporting something
If you find a vulnerability, a phishing domain using our name, or an account impersonating us, report it through https://x.com/poolsperps. Include what you saw and where. Do not include private keys, seed phrases, or session keys in any report, to us or to anyone else.
Related reading: real trading, funding, and moving money in and out.