Venues & custody

A venue is where a trade happens. Every venue sits behind the same adapter interface with one activation handshake — your integration code does not branch per venue — but each venue keeps its own custody model, because that is what makes the system non-custodial rather than non-custodial-in-name.

The venue model

The rule across all venues: the execution service can submit trades, it can never withdraw. What enforces that differs per venue and is listed below — it is always the venue's own credential mechanism, never a policy promise.

Venue reference

Name
spot
Type
live
Description
Spot copying on EVM. Custody: an ERC-7579 smart session scoped to swap routers with an explicit spend cap and hard expiry — it cannot transfer tokens out and dies at validUntil. Activation: one on-chain transaction (enable session); gas paid by the user or a paymaster. Requires an ERC-7579 smart-account wallet.
Name
hyperliquid-perps
Type
live
Description
Perps copying on Hyperliquid. Custody: an agent key the user approves in their own wallet and can revoke at any time; agent approvals do not expire. Activation: 1–2 signatures, no gas, works from any EOA.
Name
polymarket-perps
Type
in validation
Description
Perps copying on Polymarket. Custody: a delegated proxy signer with expiresIn (default ~1 week), renewable by re-running activate(). Activation: one EIP-712 signature.
Name
polymarket-predictions
Type
in validation
Description
Prediction-market copying on the Polymarket CLOB. Custody: a scoped proxy delegation whose expiry you set. Activation: one personal_sign signature. Prediction risk config adds maxSlippagePoints and minHoursToResolution.

Polymarket venues are implemented but not yet live. They run behind the same activation handshake and are in final end-to-end validation against the live CLOB. We list a venue as live only when it is — listVenues() returns what your key is actually entitled to, so ask rather than assume.

Expiring credentials

Hyperliquid agent approvals do not expire. Polymarket delegations do — and spot sessions end at validUntil. Handle the session.expiring signal and re-run activate() to renew.

An agent whose credentials lapse moves to status expired. This is deliberately distinct from paused: an expired agent needs the user to re-authorise in their wallet, not just a resume call from your app.

Agent status

Name
active
Type
status
Description
Credentials valid, mirroring the leader.
Name
paused
Type
status
Description
Stopped by the user or your app; resumable without re-authorisation.
Name
expired
Type
status
Description
Credentials lapsed; the user must re-authorise via activate(). Not resumable silently — surface it in your UI.