Skip to content

    Press / to search, [ and ] for the previous and next page.

    EN

    Security

    Official signatures

    If a signature request is not on this page, it does not come from us. Refuse it.

    Typed messages (EIP-712)

    Your wallet shows the domain name and the message type of every typed message. These are all of them:

    TypeDomainWho signs
    OpenPositionBacktrade Exchange v1wallet or session key
    CloseBacktrade Exchange v1wallet or session key
    WithdrawToCoreBacktrade Exchange v1wallet only
    RegisterSessionKeyBacktrade Exchange v1wallet only
    RegisterSessionKeyV2Backtrade Exchange v1wallet only
    RevokeSessionKeysBacktrade Exchange v1wallet only
    StakeBacktrade Staking v1wallet only
    UnstakeBacktrade Staking v1wallet only
    ClaimBacktrade Staking v1wallet only
    DistributeBacktrade Staking v1wallet only
    CancelIntentBacktrade Intent Cancel v1wallet or session key
    UnlockTradingKeyBacktrade Trading Key v1wallet only

    personal_sign

    Backtrade public profile: {action} display name "{name}" for wallet {address}
Requested at {timestampMs} (Unix ms). This only changes the name shown on public rankings; it cannot trade, withdraw or move funds.
    Backtrade Terms of Service v{version}
Address: {address}
Timestamp: {timestampMs}

    The domain’s verifying contract is always the Exchange or the Staking contract of the network you trade on; check it against contracts. The chain id must be the network’s own.

    The one you sign most: RegisterSessionKey

    Pressing “Enable trading” asks your wallet to sign RegisterSessionKey. It names a new key, its expiry and your account. Sign it only right after you pressed that button in our app, on our domain. A phishing site that obtains this signature gets a key that can trade your balance (not withdraw it) until you revoke it.

    Unlocking the trading key

    If you turned on wallet unlock for your session key, the app asks your wallet to sign UnlockTradingKey (listed above) under its own domain name, with the Exchange as verifying contract. It unlocks the key stored on this device; no contract ever sees it.

    Hyperliquid actions

    Some deposits and withdrawals use Hyperliquid’s own user-signed actions, which your wallet shows with Hyperliquid’s domain:

    • Depositing from your Hyperliquid account: a class transfer from perp to spot (only if your USDC is perp collateral), then a spot send of USDC to your deposit address. The destination must be the deposit address the app shows for your account.
    • Withdrawing onward to HyperEVM: a send of USDC from your HyperCore spot account to HyperEVM, for your own address.
    • Withdrawing onward to Ethereum, Arbitrum or Solana: a send of USDC through Circle’s deposit contract to the destination you entered.

    The app never asks for a Hyperliquid transfer to an address you did not enter or that is not your deposit address.

    Token approvals

    Deposits from HyperEVM and the bridged chains need one approval for the exact deposit amount, to the contract that takes the deposit: Circle’s HyperCore deposit contract, Circle’s CCTP token messenger, or the Across spoke pool on Robinhood Chain. The app never asks for an unlimited approval.

    Plain-text messages

    These are signed as plain text (personal_sign); the placeholders in braces are filled in by the app:

    • the display-name message (setting or clearing your public name on rankings),
    • the Terms acceptance message.

    What we never ask

    • Your seed phrase or private key, ever.
    • An approval of the exchange’s own token (staking needs none).
    • A signature on any other site than ours.
    Last updated: