Non-custodial execution

By default Scienter never touches your keys. If you choose to enable execution, it works through a purpose-built smart contract, ScopedExecutor, that can only do exactly what you signed and nothing else.

​

The one-paragraph version

You sign one EIP-712 message authorizing exactly one trade — a specific token in, a specific token out, an exact amount, a worst acceptable price, an expiry, and a single-use nonce. Scienter relays that message to ScopedExecutor on Base and pays the gas. The contract re-derives your signature, re-checks every bound, and reverts if any is missing. There’s no owner, no pauser, no proxy, and no upgrade path — “Scienter can’t take your money” is a property of the deployed bytecode, not a promise about our conduct.

​

The venue caveat — read this first

Scienter’s suggestion engine watches Hyperliquid perps, Hyperliquid vaults, OKX lead traders, and Polymarket. None of those settle through an EVM DEX aggregator on Base. ScopedExecutor executes EVM spot swaps on Base — a real, working, non-custodial primitive for Base-settled trades, and the provenance binding the Alpha Ledger needs, but it does not replace ghostcopy/executor.py, which still loads a Hyperliquid API key and remains the actual custody exposure for Hyperliquid trades today. Anyone reading “non-custodial execution” should know exactly which trades that currently covers: Base-settled swaps, not the perps Scienter actually suggests copying.

​

Enforced vs. recorded

This is the distinction people get wrong, so it’s explicit everywhere: contract, SDK types, and signing UI. The recorded fields are still signed, so nobody can forge what you claimed — but you can claim something that doesn’t match the tokens, and any leaderboard built on them must treat it as an attributed claim, not a proof.

​

What a compromise of Scienter actually costs you

If an attacker took every key Scienter operates (the relayer, the API host, the frontend) simultaneously:

• They can execute orders you already signed, within the bounds you set, before they expire, and choose a worse-but-still-above-floor route.
• They cannot alter any signed field, create an order, sign as you, redirect proceeds, touch a token you didn’t name, exceed your amount, execute after expiry, or reuse a nonce.

The 15-minute default expiry (24h hard ceiling) bounds the first case.

​

Standing scopes vs. per-trade orders

A standing scope trades the number of times you’re asked for the size of each trade — not more money at risk per trade, just less friction. If you’re not comfortable with a named party trading without asking each time, use the per-trade path; nothing requires a scope.

​

What this does NOT protect

Stated plainly, because a landing page wouldn’t:

1. It does not make copy trading profitable. Non-custodial execution changes who holds the keys. It does not change the distribution of returns — most copiers still lose money.
2. It does not protect you from your own bad delegation. A $50,000 daily cap on a bad strategy is a faithful, fully non-custodial way to lose$50,000 a day.
3. It does not protect against a malicious frontend. A compromised page could show you one thing and ask you to sign another — your wallet’s own signature dialog, not Scienter’s modal, is the authoritative record of what you’re authorizing. Read it.
4. It has not been independently audited, and is not deployed to mainnet — no contract address exists as of this writing. The self-review findings (13 items, all fixed or explicitly accepted with reasoning) are in the repository’s SCOPED_SIGNATURE_EXECUTION.md and are not a substitute for a third-party audit.

Full compliance framing (Lowe v. SEC) is in Disclaimers.