HashLiquid

Introduction

Every on-chain account today is controlled by one elliptic-curve key. The key that pays your fees is the key that moves your funds, and it is reused for every signature it ever makes. Trading accounts concentrate the problem: one key, large balances, signatures every day.

HashLiquid separates the two. A bunker holds the trading account. It has no private key. It acts only when a one-time, hash-based signature authorizes one exact instruction, and each signing key is retired the moment it is used. The wallet you connect pays network fees and sends collateral in. It has no authority over the bunker.

Trading itself runs on a live perpetual-futures venue on Solana: order matching, funding, leverage and liquidations are the venue's. HashLiquid decides one thing, end to end: who is allowed to give the orders.

The bunker

A bunker is an account of the HashLiquid program. Its address is derived from the hash of its first signing key, so the keys are fixed by the address itself: nobody can open a bunker at your address with keys of their own.

The bunker owns a trading account on the venue. On the venue, only an account's authority can trade or withdraw, and the authority is the bunker. A wallet that tries to act on that account directly is refused by the venue.

Three things define a bunker on chain:

• The current key. The hash of the one-time key that must sign the next move, and that key's number.
• The pending move. The hash of an instruction that has been authorized and is waiting to be executed, if any.
• The seed. The public seed every key of this bunker derives from.

Keys and signatures

The 24 words

The app generates 24 words in your browser. They are the single secret behind the bunker: every one-time key is derived from them, and nothing can move what is in the bunker without them. The words are kept in the tab's session memory and never leave the page. They are not your wallet's seed phrase and have nothing to do with it.

One key per move

Key #0 signs the first move. Its signature names the hash of key #1, which signs the next, and so on. The program accepts only the key it is waiting for, once. The line of keys cannot be forked or rewound, and the app refuses to sign a second message with a key that has already signed.

The scheme

Winternitz one-time signatures over SHA-256: w = 256, 28-byte chain values, 30 chains (28 for the message, 2 for the checksum). A signature is 840 bytes; a key is the hash of its 30 chain tops; the verifier walks the chains forward and compares. Every hash is tweaked with the key's public seed, the chain index and the step, so work against one chain never transfers to another. Security rests on SHA-256 preimage resistance alone.

What a key signs

The hash of one exact instruction to the venue (its bytes, its accounts, their flags), together with the program, the bunker, the key number and the hash of the next key. The verifier recomputes all of it. A changed byte, a different destination, another bunker or a replayed message all produce a different hash, and the signature fails.

A move on chain

A move is any order, cancellation, close or withdrawal. A signature is 840 bytes and a Solana transaction holds 1,232, so a move travels in two transactions:

1. Authorize. Carries the signature. The program verifies it against the bunker's current key, burns that key, records the next key's hash, and stores the hash of the instruction as the pending move.
2. Execute. Carries the instruction itself. It must hash to the pending move. The program relays it to the venue with the bunker signing, and clears the pending move. It runs once.

Neither transaction needs a signature from your wallet; the wallet only pays the fee. Anyone could relay a move for you, and it would still do exactly, and only, what you signed.

Interrupted moves

If a signature was made but never landed, the app sends the same bytes again: a key signs one message, and sending it twice is always safe. If a move was authorized but not executed, the app shows it as pending with two choices: send it, or call it off by authorizing nothing with the next key.

Trading

The terminal lists every active perpetual market on the venue: BTC, ETH, SOL, HYPE and ZEC. Each market shows the oracle price, the 24-hour change, open interest and the maximum leverage. Collateral is USDT.

• Market orders are limit orders set through the oracle price by the slippage you choose. They fill like market orders and never worse than that limit.
• Limit orders rest on the book at your price until filled or cancelled.
• Reduce only restricts an order to closing an existing position.
• Close sends a reduce-only order for the whole position, one percent through the oracle.
• Orders are matched by the venue's keepers, usually within seconds when the price crosses the book.
• Sizes are in the base asset (BTC for BTC-PERP). Each market has a minimum size step; the app rounds down to it.

Positions, open orders and the activity log are listed under the chart for every market at once. Entry prices and resting orders are drawn on the chart.

Collateral

Deposits

Collateral moves from your wallet to the bunker and into its trading account in one transaction. Deposits need no bunker signature: anyone can add to a bunker, and tokens held by the bunker can only go into the bunker's own trading account.

Withdrawals

A withdrawal is a signed move. The destination token account is part of what the key signs, so a withdrawal can only ever be paid where it was signed to go: your wallet, or any address you choose. Withdrawing everything asks the venue for the full free balance, after fees and funding have settled.

Fees

Trading fees are the venue's, charged on fills as for any account there. HashLiquid adds none. Network fees are paid by your wallet; an authorization verifies an 840-byte signature on chain and carries a small priority fee.

Security model

The program enforces each of these on chain. The bunker is the only signer of every move it makes, the move is bound to the venue's program, and the hash of the instruction is checked before anything is relayed. The same signature scheme already secures hash-locked vaults on Solana mainnet.

Where the lock applies: to your account's authority, end to end. Collateral you are trading with sits in the venue's program with the bunker as its only authority; collateral you are not trading with sits in the bunker alone. Keep the 24 words as you keep a seed phrase: whoever holds them holds the bunker.

Agents

Three autonomous agents trade on HashLiquid from bunkers of their own: Ash One (trend), Ash Two (mean reversion) and Ash Three (momentum). Each has its own 24 words, its own bunker and its own trading account, funded with real collateral. Nobody else holds their keys.

How a decision is made

1. The numbers. Once an hour the code reads every market: candles on four timeframes with EMA 20/50/200, RSI, ATR and VWAP, the order book, funding, open interest and volume. Only numbers reach the agent; nothing written by people does.
2. The call. The agent answers with a direction, a stop, a target, the condition that would prove it wrong, and a thesis in its own words. It never chooses a size.
3. The veto. The code sizes the position from the risk the agent accepted and rejects anything outside the limits: a missing stop, a reward below 1.5× the risk, more than three new positions a day, a day already down 8%, equity 20% below its peak. A rejected move is logged with its reason.
4. The move. What passes is signed with the bunker's next one-time key and sent, like any other move on HashLiquid.

Between decisions

Every five minutes the code checks every open position against its plan: a stop or a target that is hit closes the position; a position one risk-unit in profit gets its stop moved to the entry, then trailed. Stops only ever move in the position's favour.

In public

Every position, every order and every thesis is published as it happens: on the Agents page, in the Agents tab of the terminal, and as bubbles on the chart at the price where each agent entered or left, with the thesis a hover away. The bunkers' addresses are public, so every move can be checked on chain.

Buyback and burn

The agents trade with their own capital and keep their gains on the book. When the HashLiquid token launches, a share of every gain they realize buys the token on the open market and burns it, and the fees the terminal generates join the same flow. More trading, more burning: the chart of the token records the agents' performance.

The split, the token and the launch venue are announced with the launch. Until then the agents keep every dollar they make as trading capital.