Under the hood
This page answers the two questions people ask most often: what permissions does Verus actually have over your account, and how does a trade get opened on your behalf? It is written to be precise rather than reassuring. If something is not described here, assume Verus does not do it.
Your wallet and who holds the key
When you sign up, an embedded wallet is created for you. It is your wallet: your USDC sits in it, and every position is opened in your name.
The private key for that wallet is held by Privy, the wallet infrastructure provider Verus uses. The key never touches Verus servers, and Verus cannot export it. Verus can only ask Privy to produce a signature, and only for the specific kinds of messages described below. That list is an allow-list: a request for anything outside it is refused at the signing layer, before your key is used.
The one-time permission grant
The first time you use Verus, you approve a named signer: an identity that Verus uses to request signatures from your wallet. That signer is bound to a signing policy that defines which messages it may ever be used for.
This approval is a standing grant: it is what lets Verus route and place trades without prompting you to confirm each one. It is bounded three ways: by the signing policy, by the server-side checks described on this page, and by the venue-scoped keys described further down.
When your wallet is activated, Verus’s servers confirm that the named signer on your wallet is bound to exactly the expected policy and no other. That proof expires after 24 hours: the next time you use the app after it has expired, the binding is checked again rather than trusted. If the binding does not match, signing is blocked until it is resolved.
These are the signatures Verus requests, and the only signature families the policy permits:
- Venue account setup. The one-time messages that open your trading account at an order-book venue (Hyperliquid, Lighter, Orderly).
- USDC deposits. Transfers of USDC to venue deposit addresses determined by Verus’s servers, plus the standing USDC approval Orderly’s deposit contract requires, so a trade can be funded.
- Withdrawals. Requests to move funds from a venue back to your own wallet, and to no other address.
- Gas permits. Small USDC permits, capped at 1 USDC per operation and pinned to the Circle Paymaster, which is how you pay gas in USDC instead of ETH. Both the cap and the paymaster pin are enforced at the signing layer. See Fees.
- GMX order instructions. Signed instructions to create, edit, or cancel GMX orders.
- User operations. The transaction envelope behind on-chain actions where gas is paid in USDC: Ostium trades, deposits, and the sends you make from the app.
- A one-time account upgrade that lets your account pay gas in USDC. It is pinned at the signing layer to one specific account implementation, so no other can be authorized.
Sending USDC out to an external address of your choosing is a separate action that you take in the app and sign yourself. It is not part of the trading flow.
What Verus cannot do
Some of these limits are enforced inside the signing layer itself, meaning the request is rejected before your key is ever used. Others are enforced by Verus’s servers before a signature is requested. Both are listed here, and the difference is spelled out on Security.
- It cannot export your key. Key export is denied at the signing layer.
- It cannot use drainer-style signatures. Producing a raw pre-signed transaction is denied at the signing layer, as are the signature shapes commonly used to sweep a wallet.
- It cannot request a message type that is not on the list. A signature request matching no rule in the policy is refused at the signing layer.
- It cannot exceed the gas cap. A gas permit above 1 USDC per operation, or pointed at anything other than the Circle Paymaster, cannot be signed at all.
- It cannot send a withdrawal anywhere but your own wallet. Venue withdrawals are locked to your wallet address as the destination.
- It cannot move funds while you are idle. There is no pooled Verus account to move them into. Between trades your funds sit in your own wallet (plus any balance still at a venue from an earlier trade, which stays yours and is reused the next time you trade there), and nothing in the trading flow has a reason or a route to touch them.
How an order executes, end to end
Quote
Every venue that can support your exact trade is priced for that trade: venue fees, expected slippage at your size, funding or carry over the hold time you entered, gas, and the cost of getting collateral in and back out. See Best execution.
Route
Verus picks the venue with the lowest all-in cost. Routing is balance-aware: a venue your wallet cannot currently fund is demoted in the ranking rather than hidden from the comparison. Any venue you have turned off in your settings is excluded entirely.
Fund
Only the margin for this trade moves from your wallet to the routed venue. Nothing else is moved, and nothing is pre-positioned in advance. On GMX and Ostium there is no separate deposit step at all: the collateral travels inside the order transaction itself.
Place
The order is placed at the venue. How that happens depends on the venue type, which is the split described next.
Order-book venues: a venue-scoped trading key
On Hyperliquid, Lighter, and Orderly, your account is set up once with a venue-scoped trading key that Verus holds. That key places and cancels orders for you, which is what removes a wallet confirmation from every trade. It is scoped to trading at that one venue:
- Hyperliquid. The trading key cannot withdraw funds.
- Orderly. Withdrawing requires an additional wallet-level signature, issued through the policy-bound signer described above, so the trading key alone cannot move funds out.
- Lighter. Withdrawals always land at your own wallet, and each one needs an additional wallet-level signature through that same signer.
Pool-based perps: a signed intent per action
On GMX and Ostium there is no venue account and no trading key. Your wallet signs an explicit intent for each action, and Verus relays it on-chain.
Before requesting that signature, Verus’s servers independently re-validate what is about to be signed: the instruction is decoded and checked against the action you asked for, and any order whose proceeds would not land in your own wallet is refused. Anything that does not match is not signed.
Where your funds sit at every stage
| Stage | Where your funds are |
|---|---|
| Idle, between trades | In your own wallet |
| Position open on an order-book venue | The margin for that position is at the venue, the rest stays in your wallet |
| Position open on GMX or Ostium | The margin rides inside the position itself, the rest stays in your wallet |
| After you close | Back in your own wallet |
Funds return to your wallet when a position closes, including automatically when a take-profit or stop-loss fires at the venue while you are not looking. Two practical caveats: an amount below the venue’s withdrawal minimum waits at the venue until it can be withdrawn, and funds still backing another position or a resting order at that venue stay there until those are closed. Anything waiting at a venue remains yours and is visible in the app.
There is no Verus-held balance at any stage of a perp trade. Every number above is in your wallet, in a position opened in your name, or in a venue account that belongs to you. (Copy trading is a separate product with a separate, custodial wallet. See Copy trading.)
Next: Security covers the guardrails and your own responsibilities, and Fees covers what each venue charges.