# Hyperliquid trading wallets

> How each tango.finance perps strategy trades from its own Privy wallet that you and Tango own together, what its policy lets it sign, and what an agent wallet and Tango can do on their own.

Source: https://app.tango.finance/docs/app/venues/hyperliquid-wallets

Each strategy with perps trades from its own wallet on Hyperliquid. The vault contracts cannot reach funds on Hyperliquid, so this wallet's controls matter. On tango.finance, agents trade for you, so the wallet lets a Tango-held agent wallet place orders and lets Tango send cash back to your strategy, while everything else still needs both you and Tango. This page explains who controls the wallet, what it can and cannot sign, and what happens if one party is unavailable.

> **Key points**
>
> - Each perps strategy trades from its own wallet, held with Privy, a wallet service. A 2-of-2 key quorum owns it: you and a dedicated Tango key. Neither can change it alone.
> - A Privy policy limits what the wallet can sign. Cash can leave Hyperliquid only towards the strategy's own Perps account on Base.
> - An agent wallet that Tango holds places orders for your strategy's agents. It can trade, but it cannot move cash anywhere.
> - Tango can send USDC back from Hyperliquid on its own, but only to your strategy's Perps account, from where it can only go to the vault.

## Which wallets are involved?

| Wallet | Held by | Can sign |
| --- | --- | --- |
| Trading wallet, one per strategy | A Privy wallet owned by a 2-of-2 quorum: you and Tango's perps key | What its policy allows. Most actions need both owners' signatures |
| Agent wallet, one per strategy | Tango's execution service | Hyperliquid exchange actions for this trading account only: orders, cancels, modifies, leverage and isolated margin, and moves of margin within the account |
| Your Tango wallet | You | Nothing on Hyperliquid. It is the vault's admin on Base |
| NAV attester, one per strategy | A key held by Tango's NAV service | Only posting this strategy's Perps account value |

A **2-of-2 quorum** means two keys own the wallet, and both must approve before it signs anything outside the narrow rules below. Tango creates the trading wallet before the vault is deployed, and its address is written into the Perps account's approved bridge transfer as the only recipient.

## Setting up the wallet

Once the first transfer reaches Hyperliquid, setup asks you to approve four steps. Tango signs each one too.

1. A policy change that keeps every existing rule and adds two narrow ones: one that allows a single agent approval, and one that lets Tango's signer send USDC back to the strategy's Perps account, and nowhere else.
2. Registering the agent wallet with Hyperliquid, so it can trade for this account.
3. Setting the account to Hyperliquid's standard mode.
4. Approving Tango's builder fee, at exactly Tango's rate and builder address.

After that, agents can trade without asking you for each order.

## The policy

A **policy** is a set of rules that Privy checks before the wallet signs. Every signature the trading wallet produces must pass its policy, and the same 2-of-2 quorum owns the policy, so changing it needs both you and Tango.

| Allowed | Pinned to |
| --- | --- |
| Hyperliquid exchange actions: orders, cancels, modifies, leverage and isolated margin updates, moving collateral between the account's own balances | Hyperliquid mainnet's signing domain |
| Switching to standard account mode | Mainnet, standard mode only |
| Approving a builder fee | Tango's builder address and exactly Tango's fee |
| Approving one trading agent | The agent wallet registered at setup |
| Sending USDC back to Base | USDC only, the Base bridge route, and this strategy's Perps account as the only recipient |

| Denied |
| --- |
| Sending USDC or other tokens to any other address, on Hyperliquid or elsewhere |
| Withdrawing through any other route |
| Any EVM transaction on any chain |
| Exporting the private key |

### Why can't the policy check every order?

Hyperliquid exchange actions are hashed before they are signed, so Privy cannot read individual order fields. Tango's checks keep orders to the strategy's markets and limits instead: the order planner, the grant your agents run under, and Tango's re-check before it signs. Actions that move money work differently. They are signed as readable typed data, so Privy enforces their recipient directly.

## The agent wallet

The agent wallet places your strategy's orders. Its own policy allows only Hyperliquid exchange actions and denies key export. Tango narrows it further:

- to orders, cancels, modifies, leverage and isolated margin changes, and moves of margin within the account;
- to the strategy's chosen markets, each market's Max Leverage, and a slippage limit, frozen in the grant you signed at setup.

It cannot sign a withdrawal or any other transfer. Turning Agentic Rebalancing off stops agents from deciding anything new. Close and Reduce still run through the agent wallet, under the approval you gave at setup.

## Who can do what alone?

| Party | Can do alone | Cannot do alone |
| --- | --- | --- |
| You | Turn agents off, lower Max Leverage, deposit, withdraw idle cash, and change limits and roles on the vault | Trade on Hyperliquid, or move cash on Hyperliquid |
| Tango | Trade through the agent wallet within your agents' grant. Send USDC back to the strategy's Perps account. Refuse to sign. Pause actions that add risk for every strategy. Post the Perps account's value within the vault's band | Send cash anywhere else, export the key, or change the policy |
| Anyone else | Nothing | Anything |

Even with both signatures, USDC on Hyperliquid can only leave towards the strategy's own Perps account on Base. From there, it can only go back into the vault.

## What if something is unavailable?

| Situation | Effect |
| --- | --- |
| Tango's services or Privy are down | No new orders and no transfers from Hyperliquid. Orders already resting on Hyperliquid, including stop losses and take profits, and liquidations carry on there |
| Tango's NAV service is down | The Perps account's value goes stale once it passes its heartbeat. Deposits and withdrawals wait, and the Perps account cannot bring cash back to the vault while its value is stale |
| You are unavailable | Agents keep running the strategy by its rules. Nothing on Hyperliquid needs you after setup |
| Tango's perps key is lost | Nothing that needs both owners could be signed, including policy changes |

These are the trust assumptions of trading on an offchain venue. See [Perps on Hyperliquid](https://app.tango.finance/docs/app/venues/hyperliquid.md#risks-specific-to-perps).