Custody and safety · Non-custodial

Connecting a Wallet to a Perp DEX Without Handing Over Your Funds

Open Trending →

Signing a message vs approving a transaction

When you click “connect wallet” on a DeFi or perp DEX site, you will see one of two core prompt types from your wallet software. It is critical to tell them apart before clicking confirm.

A message signature (often labeled “Sign In With Ethereum” or “SIWE”) is a cryptographic proof that you control the wallet address. It costs no gas, makes no changes to on-chain state, and grants the site no permissions to move funds or act on your behalf. It is the equivalent of showing a bouncer your ID to prove you are on the list — you are not handing over your keys. If you only sign a message, the site can view your public address and transaction history, but cannot take any action with your assets.

An approval or authorisation transaction is an on-chain action that costs gas and permanently (until revoked) grants a third party permission to take specific actions on your behalf. This is the prompt that carries risk, because the scope of permission can vary widely. A common example is an ERC20 “approve” transaction, which lets a smart contract pull tokens from your wallet up to a set limit. For perp DEXes, a common authorisation is adding an agent key to your DEX account.

Never approve a transaction if you cannot clearly see what permissions are being granted, or if the prompt is from a site you do not trust.

What a trading agent key can (and cannot) do with withdrawal permissions disabled

Many non-custodial perp DEXes use an agent key system to let third-party interfaces, trading tools, or automation platforms act on your account without giving them full access to your wallet. An agent key is a limited, permissioned signer that is tied only to your DEX account, not your entire wallet.

When an agent key is authorised with withdrawals explicitly excluded from its scope, its capabilities are strictly bounded by the DEX’s on-chain smart contract rules.

What an agent key can do (if trading permissions are enabled):

• Open and close perpetual futures positions
• Adjust leverage and margin for existing positions
• Place, cancel, and modify limit and stop orders
• Move funds between the DEX’s spot and perp vaults within your own account
• Claim on-chain trading rewards or rebates tied to your account

What an agent key cannot do, when withdrawals are disabled:

• Withdraw any funds from your DEX account to an external wallet address
• Transfer assets to another user’s DEX account
• Change the main owner signer of your DEX account
• Interact with any protocol or smart contract outside the DEX’s system
• Access any assets held in your main wallet that are not deposited into the DEX

Trending uses this exact model: the agent key is authorised on your Hyperliquid account with withdrawals disabled, so funds stay in your own Hyperliquid account. The 0.02% builder fee is shown before every trade confirmation and is verifiable on-chain, so you never pay an unlisted fee.

Critical risk to note

Even with withdrawal permissions disabled, an agent key with trading access can still open or close positions that result in trading losses. You remain fully exposed to all market risk of positions the agent executes on your behalf. If you do not trust the party controlling the agent key to trade responsibly, you should not grant the permission. If you prefer to sign every trade individually, trading directly on the DEX’s native interface is a better fit.

Why “non-custodial” is verifiable, not just a promise

Many trading sites claim to be non-custodial, but the label only means something if you can verify it yourself on-chain. A truly non-custodial perp DEX holds your funds in a smart contract account that you control via your main wallet, not in a company-owned wallet or internal database.

You can verify control of your funds in three concrete steps, no trust required:

1. Confirm account ownership: Look up your wallet address on the DEX’s official block explorer or on-chain state viewer. The DEX account should list your main wallet address as the sole owner, with no third party listed as a controller.
2. Review agent key permissions: Any agent keys added to your account will be visible on-chain, along with their exact permission scopes. You can confirm that a trading agent key has withdrawal permissions disabled directly from the on-chain state, not just from the third-party site’s claims.
3. Verify fee structure: All trading fees, including any third-party builder fees, are recorded on-chain. You can cross-check the fees charged on your trades against the published fee schedule to confirm you were not overcharged.

For context, custodial platforms cannot pass this check: your funds are held in the platform’s own wallets, and you have no way to verify their internal accounting. With a non-custodial DEX, the blockchain is the single source of truth for who owns your funds and what permissions are active.

Trending’s setup meets this verifiability standard: your funds never leave your own Hyperliquid account, the agent key’s no-withdrawal scope is recorded on Hyperliquid’s on-chain state, and the 0.02% builder fee is auditable on every trade.

How to review and revoke trading permissions at any time

You do not have to rely on a third-party trading tool to remove its own access. Agent key permissions are managed directly on the DEX’s own system, so you can review or revoke them at any time, even if the third-party site is offline or unresponsive.

The exact steps vary slightly by DEX, but the general process is:

1. Go to the official, native website of the perp DEX (not the third-party trading tool) and connect your main wallet signer.
2. Navigate to the account settings section labeled “API Keys”, “Agent Keys”, or “Authorized Apps”.
3. Review every listed key: check its permission scope (withdrawals enabled? trading only?), creation date, and associated label. If you do not recognize a key, assume it should be revoked.
4. To revoke a key, select the “Revoke” or “Delete” option next to the key, and sign the required gas transaction. Once the transaction confirms on-chain, the key will no longer be able to take any action on your account.

A few important notes:

• Revoking an agent key does not close any open positions on your account. It only removes the third party’s ability to manage those positions. You remain in full control of all positions and funds via your main wallet.
• Agent key permissions are separate from ERC20 token approvals. If you have previously granted wallet-wide ERC20 approvals to any protocol, you can review and revoke those using a block explorer’s approval checker tool.
• For Hyperliquid-based tools like Trending, you can manage all agent keys directly from Hyperliquid’s official account settings page. You do not need to interact with Trending at all to revoke its access.

Try it on the chart →