Wallet & Security

How Ritdex stays non-custodial — your keys and funds never leave your control. The agent-key trading model, what every signature can and cannot do, key storage, and how to stay safe.

Ritdex has no login, no password, and no account database. Your wallet is your identity, every sensitive action is authorized by a cryptographic signature, and — most importantly — Ritdex is non-custodial: your keys and your funds stay under your control at all times.

Non-custodial by default

"Non-custodial" (không lưu ký) means Ritdex never holds your private key and never holds your money. It is a front-end that reads your public address and helps you sign your own transactions — nothing more. The split is absolute:

You control

Your seed phrase & private key
Trading funds (Hyperliquid margin)
Wallet balance
Every withdrawal

Ritdex can only

Read your public address
Attach the builder fee to your fills
Place orders via a trade-only agent

Ritdex can never

Touch your seed or private key
Withdraw or move your funds
Claim or drain the reward vault

Your seed phrase and private key live in your own wallet (the built-in Ritdex wallet, or an external wallet like a browser extension / mobile wallet). They are never transmitted to Ritdex servers.
Your trading funds sit in your own Hyperliquid margin account, controlled by your key.
Your rewards accrue in an on-chain vault that only you can release.

Where your funds actually live

Asset	Held by	Can Ritdex move it?
Wallet balance (USDC, tokens)	Your self-custody wallet	No
Perps trading margin	Your Hyperliquid account (your master key)	No
Unclaimed commissions & rewards	`RitdexRewardVault` smart contract on Arbitrum One	No — released only by your signed claim

At no point does your money pass through a Ritdex-controlled wallet. Deposits, withdrawals, and reward claims are all on-chain actions you sign yourself.

How trading stays non-custodial — the agent-key model

To place orders on Hyperliquid without asking you to sign every single click, Ritdex uses Hyperliquid's agent (API) wallet system:

When you Enable Trading, you authorize a trading agent — a Hyperliquid API wallet scoped to your account.
That agent can place, modify, and cancel orders on your behalf, so bots and copy-trading can run smoothly.
Crucially, the agent cannot withdraw or transfer your funds. On Hyperliquid, moving money out always requires your own master signature — the agent key simply has no such permission.

Think of the trading agent as a valet key: it can drive (trade), but it can't open the trunk (withdraw). Your master key — the one that can actually move funds — never leaves your wallet.

The builder fee works the same way: enabling trading approves the Ritdex builder once so a small fee attaches to your fills (see Fees) — that approval also carries no power to move your funds.

What you sign — and what it cannot do

Nothing is ever auto-signed. Every action below is an explicit, in-the-moment signature from your wallet:

Action	Signature	Authorizes	Cannot do
Connect wallet	none	Read your public address to show balances/positions	Move anything
Enable trading	Approve agent + builder	Place orders; attach the builder fee	Withdraw or transfer funds
Bind a referral code / IB Agreement	EIP-191 (`personal_sign`)	Link your address to a referrer / accept partner terms	Access funds
Claim a reward	EIP-712 (typed data)	Release your own accrued USDC from the vault to your address	Drain the vault, or touch anyone else's balance

EIP-712 payloads are human-readable in most wallets — before you claim, you can see exactly which contract, which amount, and which recipient (always your own address) you are authorizing.

Key storage & what our servers see

Your private key / seed phrase is stored locally and encrypted. With the built-in Ritdex wallet it is protected by your device PIN/biometrics and never uploaded; with an external wallet it stays inside that wallet. Ritdex has no API that can read it.
Ritdex servers only ever see public information: your wallet address, your on-chain positions and fills (read from Hyperliquid), and your accrued rewards. They never see your key, and have no path to move your money.
No KYC, no PII. Ritdex collects no identity documents, email, or phone — for traders, referrers, and IB Agency partners alike. Your wallet address is your identity.

Because there is no KYC and no centralized recovery, losing your wallet means losing access to that address's Ritdex history and any unclaimed rewards. Back up your seed phrase through your wallet provider — Ritdex cannot recover it for you, and neither can anyone else.

Rewards are non-custodial too

Every commission, override, rebate, and Loyalty reward accrues in the on-chain RitdexRewardVault (Arbitrum One). Ritdex's backend can authorize a claim (via an EIP-712 signature that credits the amount owed to your address), but it cannot withdraw the vault to itself and cannot send your rewards anywhere except your own wallet. You claim 24/7, on demand, and the USDC lands directly in your wallet in about two seconds.

The one custodial exception (opt-in, coming soon)

There is a single planned mode where funds are held on your behalf: a custodial automation mode for hands-off Copy Trade and bots, where your capital sits in a segregated sub-account so strategies can run without you signing each trade.

It is opt-in and coming soon — the default Ritdex experience remains 100% non-custodial.
Even there, safety is built in: keys are protected by a hardware security module (KMS), every action is written to a tamper-evident audit log, and the only fee is 10% of winning trades (high-water mark) — collected in a way that cannot be bypassed or over-charged.

When it launches it will be clearly labelled as custodial before you opt in — you will always know which mode you are in.

Staying safe

Always check the domain is exactly ritdex.com before connecting or signing. Bookmark it.
Never share your seed phrase or private key with anyone — Ritdex support will never ask for it.
Read what you sign. For value-bearing actions the wallet shows a human-readable EIP-712 payload; if an amount or recipient looks wrong, reject it.
Back up your seed phrase offline, and consider a hardware wallet for larger balances.