Session keys and security

Live copying needs a Papertrade session key: a scoped key that can open and close positions on your account. Paper Strategy generates the key on its server, encrypts it at rest, and asks your wallet for one EIP-712 signature on HyperEVM (chain 999) to register it through Papertrade's relayer. It is valid for 30 days.

Hard limits enforced by Papertrade's contracts

• A session key cannot withdraw. Withdrawals always need your real wallet signature.
• It cannot stake, unstake or claim PAPER.
• Worst case if the server is compromised: an attacker could open and close positions and lose your trading balance. They could never move funds anywhere else.

Your controls

• Revoke any time by calling revokeSessionKey on Papertrade's SessionKeyManager from your wallet, or register a new key here (which the worker switches to).
• Only keep the balance you are willing to have traded in your Papertrade account.
• Pause or delete rules from the Copy tab at any time. Open mirrors stay open until the leader closes or you close them in Papertrade's app.

Signing in

Sign-in is a plain message signature proving wallet ownership. It authorises nothing. The server then checks your PSTRAT balance on Robinhood Chain and issues a 12-hour session cookie.