Security

Verus is built so that you stay in control of your funds. This page explains the model in plain terms.

Non-custodial by design

When you sign up, Verus creates an embedded account tied to your login. Verus orchestrates trades on your behalf, but it cannot take custody of your funds or send them to an address you did not authorize.

How signing is constrained

Your account runs on a Privy embedded wallet. Privy holds the key, it never touches Verus servers, and Verus cannot export it. What Verus can do is ask for a signature, and that ability is constrained in three separate layers. The signing layer works as an allow-list: the policy enumerates the exact kinds of messages Verus may request, and anything else is refused before the key is ever used. No single layer is the whole story, so all three are described here.

1. The signing layer: an allow-list plus hard denials

These are enforced where the signature is produced, so they hold regardless of what any Verus service asks for:

• Anything not on the list is refused by default. The policy lists the permitted kinds of messages. A signature request that matches no rule on that list is refused before your key is used.
• Key export is denied. There is no path for Verus to obtain your key.
• Raw pre-signed transactions are denied, as are known drainer signature shapes: the message patterns commonly used to sweep a wallet.
• Gas permits are bounded at the signing layer. A gas permit above 1 USDC per operation, or one naming anything other than the Circle Paymaster (which is how you pay gas in USDC instead of ETH), cannot be signed at all.

2. Server-side guards before anything is signed

Verus’s servers apply their own checks before requesting a signature:

• Withdrawal destinations are locked to your own wallet. A venue withdrawal cannot be pointed at a third-party address. Sending USDC out to an external address is a separate action you take and sign yourself in the app.
• Every instruction is re-validated. The exact instruction about to be signed is independently decoded and checked against the action you asked for before it is sent for signing. Anything that does not match, including anything whose funds would not land in your own account, is refused.
• The signer binding is verified. When your wallet is activated, Verus confirms that the named signer on your wallet is bound to exactly the expected policy and no other, and that proof expires after 24 hours: the next time you use the app after it has expired, the binding is checked again rather than trusted. A mismatch blocks signing until it is resolved.

3. Venue-scoped trading keys

On the order-book venues, orders are placed with a key scoped to trading at that one venue, which is why you do not confirm every trade in a wallet popup. That key is not a path out of your funds:

• Hyperliquid. The trading key cannot withdraw funds.
• Orderly. Withdrawing requires an additional wallet-level signature through the policy-bound signer, so the trading key alone cannot move funds out.
• Lighter. Withdrawals always land at your own wallet, and each one needs an additional wallet-level signature through that same signer.

For security reasons we do not publish the full rule set here. Under the hood has the complete list of what Verus can request signatures for. Suspected issues belong in Reporting a vulnerability below.

Funds return to your wallet on close

When a position closes, its collateral and any profit are returned from the venue to your own wallet. That includes closes you did not press the button for: if a take-profit or stop-loss fires at the venue while you are away, Verus brings the freed funds back automatically. An amount below the venue’s withdrawal minimum, or funds still backing another position or resting order at that venue, waits at the venue until it can be withdrawn. It remains yours and is visible in the app.

Withdrawals

Withdrawals go to an external address. Verus runs a preflight check before a withdrawal so you do not submit something that will fail (for example, below a venue’s minimum). See Deposits & withdrawals.

Your responsibilities

• Protect your login. Whoever can sign in can authorize your account. Use a secure account and enable any available 2FA.
• Verify the network and token when depositing. Send USDC on Arbitrum only. Funds sent on the wrong network may be unrecoverable.
• Beware of phishing. Verus will never ask you for a seed phrase or to verify your account on another site. The only app URL is app.verusapp.io .

Reporting a vulnerability

If you believe you have found a security issue, please report it privately by emailing team@verusapp.io. For non-sensitive questions you can also message us on Telegram . Do not post suspected vulnerabilities in public channels.