Security: who signs what
The short version is on hoodini.sh/security. This page is the longer read.
The server composes, your wallet signs
When you press Buy or Sell, the server reads the chain live — the token's real market, your balances, your allowance, a quote — and composes the transaction. It never signs. Your embedded wallet, created for you by Privy at sign-in, signs and sends it in your browser. We ask Privy for no delegation, no session signer, and hold no server-side key for any user wallet. There is no code path by which the backend can move a user's funds, and the wallet a trade uses is always the signed-in user's own, taken from the session.
What a trade may touch
The recipient of a prepared transaction is only ever one of four contracts, or the token being approved:
| Contract | Role |
|---|---|
| Uniswap SwapRouter02 | v3 swaps |
| Uniswap Universal Router | v4 swaps, any hook |
| Uniswap V2 Router02 | the few v2 pools |
| Permit2 | approvals for the Universal Router |
The addresses, linked to the explorer, are on the security page. Quotes are read-only calls to the Uniswap quoters; they sign nothing.
Baked into every swap
- A slippage-bounded minimum out on every leg, derived from the live quote and your slippage setting. A no-confirmation click cannot be sandwiched to zero.
- A multi-hop route is one transaction. A token quoted in USDG or in a tokenised stock still starts from ETH (ETH → quote through the quote's own pool, then quote → token, up to three hops). The hops are commands of a single Universal Router call: the intermediate asset never touches the wallet, one simulation covers the whole path before anything is sent, and a hop that would refuse reverts the lot — nothing can land half way.
- Gas headroom is checked before a send, so a buy cannot strand the wallet without gas for the sell.
- The route is shown before you trade: the trade box names the path and how many transactions it takes. See Trading & demo mode.
The signals bot
The live copy book trades from a wallet that belongs to hoodini, not to any user. No user wallet, key or balance is involved in it at any point, in either direction. The paper book — which is what the signals page shows unless a row says live — sends nothing and holds nothing on chain.
Accounts and data
Sign-in is Privy (an email or a wallet). We keep the session, your trade settings, your demo and real trade records, support tickets, and your IP for rate limiting. Analytics are Google Analytics 4 and Cloudflare Web Analytics; neither is given a wallet, a trade or an account identifier. The full notice is on the legal page.
Reporting a problem
Message @hoodiniapp on X. The machine-readable pointer is /.well-known/security.txt.