Security and custody
This page is written to be precise rather than reassuring. Copy trading has a different custody model from the rest of Verus, and the difference matters, so it is stated first and in plain words.
The copy wallet is custodial
Your copy wallet is not self-custody. Verus generates its Solana private key on the server, holds it encrypted, and signs with it on your behalf. You cannot export that key today. This is the opposite of the perps side of Verus, where the key is held by the wallet provider and Verus can only ask for a signature.
Do not carry the assumption across from Security. That page describes your perps account: an embedded wallet on Arbitrum whose key never touches Verus servers. The copy wallet is a separate wallet on a separate chain with a separate model.
Why it works this way
Copy trading is a race. A leader’s trade is public the moment it lands, and the price you get depends on how quickly your order follows. A wallet that needs you to approve each trade in a browser popup cannot copy anyone: by the time you tapped confirm, the trade you were copying would be minutes old and the price gone.
So the engine signs directly. That is a real trade-off, and the right way to size it is simple: fund the copy wallet the way you would fund a hot trading key. Put in what you are actively trading with, take profits out, and do not treat it as storage.
How the key is held
The key is encrypted at rest with a strong authenticated cipher, and the secret that unseals it is held outside the database, so a copy of the database alone is not a usable key. Each sealed key is bound to your account, so it is not portable to another. The plaintext exists only inside the signing process, for the moment of a signature, and is never returned by any endpoint and never written to a log.
For security reasons we do not publish the full details of the key handling, the rotation procedure or the signing policy here, in the same way the perps side does not. If you are assessing Verus and need more than this page, email team@verusapp.io.
There is no key export today. If that changes, this page changes with it.
What the engine is allowed to sign
Holding a key is not the same as being able to do anything with it. Every signature the engine produces passes a policy gate first, and the gate inspects fully resolved instructions rather than a compiled message, so nothing can be hidden behind an address lookup table.
An allow-list, not a block-list
A transaction may only touch a fixed list of programs: Solana’s own core programs, and the swap venues the engine trades through. A signature touching anything else is refused before it is produced, and adding a program to that list is treated as a security change rather than a feature. The venues are named in How it executes.
Denied outright
Some instruction types are refused no matter which program asks for them, because each one is a step in a wallet drain rather than a trade:
- Delegation and re-ownership. Approving a spender, or setting a new authority on your account or a token account, cannot be signed at all. This is the shape that lets an attacker come back later and move your tokens without a fresh signature.
- Burning your tokens.
- Bare token transfers. A token transfer that is not part of a swap the engine built is the shape of a sweep, so it is refused.
- Closing a token account to anyone but you. The rent freed by closing a finished account can only be paid back into your own wallet.
- Moving SOL to an address the transaction did not admit. Every instruction that can move lamports, including the less obvious ones such as creating an account or drawing from a nonce account, is decoded and its destination checked.
The one destination the gate accepts from outside is the one you type on a withdrawal, and only for that single transaction. See below.
Withdrawals
A withdrawal sends SOL, or USDC held as a rescue balance, from your copy wallet to a Solana address you supply.
Any valid Solana address is accepted, and a withdrawal cannot be reversed. There is no address book and no restriction to addresses you can prove you own. Check the address before you confirm.
What does guard a withdrawal:
- It is an authenticated, ownership-checked request. A user id in a request is a claim, not an identity, and every handler verifies the caller owns the account it names.
- It needs its own permission. Withdrawing is a separate capability from trading, so an agent key issued only for trading cannot move funds out.
- Double submissions collapse into one. A per-user in-flight claim means a double click, or an impatient retry, cannot send twice. If the outcome is ambiguous the claim is deliberately held rather than released.
- The audit record is written first. If the durable record of the withdrawal cannot be written, the withdrawal does not happen. There is no path where money moves and nothing recorded it.
A SOL withdrawal also settles any outstanding platform fee (see Fees and P&L) in the same transaction, so it clears your balance and your fee debt together. A USDC withdrawal moves only the USDC and leaves the SOL side untouched.
Limits that bound the engine
These are the ceilings that apply whether or not anything has gone wrong.
| Limit | What it bounds |
|---|---|
| Per-trade settings ceiling | The per-trade amount, and the maximum you set when matching a creator, cannot be set above $25,000. Percent-of-balance sizing is bounded instead by your balance and the caps below. |
| Hourly spend, per wallet | A rolling one-hour ceiling on what one copy wallet can spend. This bounds the time dimension: a runaway leader, or a bug, cannot drain a wallet through an unbounded number of individually reasonable trades inside an hour. |
| Hourly spend, platform-wide | A ceiling across every user at once. It sits above the largest legitimate burst, so tripping it means something is wrong, and it refuses new buys for the rest of the hour. |
| Exposure caps | Limits on how much you hold in one token, how much you hold in total, and how many positions you can have open. You can tighten these; you can never loosen them past the platform’s own. |
| Pause | You can pause your whole account or a single trader at any time. |
A cap does not stand between you and an exit. Withdrawing and redeeming rent are exempt from the spend caps entirely. A sell charges only its platform fee against them, never the value of what you are selling, so a cap you have reached on buying does not close the door on getting out.
There is also a kill switch on execution itself. With it off, the engine still watches and records what it would have done, and signs nothing.
What is recorded
Every mirror attempt is written down, including the ones that did not happen. A skipped trade is a row with a reason, not silence, which is why the activity feed can tell you that a trade was skipped because the signal was stale or your balance was short, rather than leaving a gap. Follows, settings changes, withdrawals, position closes and take-profit or stop-loss changes are each recorded with the time, the request and the originating IP.
You can read your own history in the app and export it as CSV. Very long histories are capped, and the export tells you when older rows were left out.
Your responsibilities
- Protect your login. Whoever can sign in can authorize spending from your copy wallet, and copy trading is designed to spend without prompting.
- Fund it like a hot wallet. Keep what you are trading with in it, not what you are saving.
- Send only SOL to it for trading. USDC that arrives is held safely but is never traded, and has to be withdrawn deliberately. Other tokens sent by hand are not managed at all.
- Check withdrawal addresses. They cannot be undone.
- Beware of phishing. Verus will never ask you for a seed phrase or private key. The only app URL is app.verusapp.io .
Reporting a vulnerability
Report suspected security issues privately by emailing team@verusapp.io. For non-sensitive questions you can message us on Telegram . Please do not post suspected vulnerabilities in public channels.