Hyperliquid trading wallets

Each strategy with perps trades from its own wallet on Hyperliquid. The vault contracts cannot reach funds on Hyperliquid, so this wallet's controls matter. On tango.finance, agents trade for you, so the wallet lets a Tango-held agent wallet place orders and lets Tango send cash back to your strategy, while everything else still needs both you and Tango. This page explains who controls the wallet, what it can and cannot sign, and what happens if one party is unavailable.

Key points

• Each perps strategy trades from its own wallet, held with Privy, a wallet service. A 2-of-2 key quorum owns it: you and a dedicated Tango key. Neither can change it alone.
• A Privy policy limits what the wallet can sign. Cash can leave Hyperliquid only towards the strategy's own Perps account on Base.
• An agent wallet that Tango holds places orders for your strategy's agents. It can trade, but it cannot move cash anywhere.
• Tango can send USDC back from Hyperliquid on its own, but only to your strategy's Perps account, from where it can only go to the vault.

Which wallets are involved?

A 2-of-2 quorum means two keys own the wallet, and both must approve before it signs anything outside the narrow rules below. Tango creates the trading wallet before the vault is deployed, and its address is written into the Perps account's approved bridge transfer as the only recipient.

Setting up the wallet

Once the first transfer reaches Hyperliquid, setup asks you to approve four steps. Tango signs each one too.

1. A policy change that keeps every existing rule and adds two narrow ones: one that allows a single agent approval, and one that lets Tango's signer send USDC back to the strategy's Perps account, and nowhere else.
2. Registering the agent wallet with Hyperliquid, so it can trade for this account.
3. Setting the account to Hyperliquid's standard mode.
4. Approving Tango's builder fee, at exactly Tango's rate and builder address.

After that, agents can trade without asking you for each order.

The policy

A policy is a set of rules that Privy checks before the wallet signs. Every signature the trading wallet produces must pass its policy, and the same 2-of-2 quorum owns the policy, so changing it needs both you and Tango.

Why can't the policy check every order?

Hyperliquid exchange actions are hashed before they are signed, so Privy cannot read individual order fields. Tango's checks keep orders to the strategy's markets and limits instead: the order planner, the grant your agents run under, and Tango's re-check before it signs. Actions that move money work differently. They are signed as readable typed data, so Privy enforces their recipient directly.

The agent wallet

The agent wallet places your strategy's orders. Its own policy allows only Hyperliquid exchange actions and denies key export. Tango narrows it further:

• to orders, cancels, modifies, leverage and isolated margin changes, and moves of margin within the account;
• to the strategy's chosen markets, each market's Max Leverage, and a slippage limit, frozen in the grant you signed at setup.

It cannot sign a withdrawal or any other transfer. Turning Agentic Rebalancing off stops agents from deciding anything new. Close and Reduce still run through the agent wallet, under the approval you gave at setup.

Who can do what alone?

Even with both signatures, USDC on Hyperliquid can only leave towards the strategy's own Perps account on Base. From there, it can only go back into the vault.

What if something is unavailable?

These are the trust assumptions of trading on an offchain venue. See Perps on Hyperliquid.