# Hyperliquid Repo Audit – 2026-06-07 ## Scope Repository: `Gamexgit/Crypto_Agent` Local path: `/home/agent/projects/CryptoTradingBot/Crypto_Agent` Working branch created for this work: `feature/hyperliquid-v76-live-preview` This audit was created before starting the v76 Hyperliquid live-preview refactor. The local branch must preserve the existing paper-trading learnings and must not be overwritten by the older GitHub V61 baseline. ## Repo check performed Commands requested by Sir were run from the repository root: - `pwd` -> `/home/agent/projects/CryptoTradingBot/Crypto_Agent` - `git remote -v` -> `https://github.com/Gamexgit/Crypto_Agent.git` - `git branch --show-current` -> initially `chore/safety-optimizations`, then new branch `feature/hyperliquid-v76-live-preview` - `git status --short` -> clean before creating this audit file - `git log --oneline -5` -> latest local commits included: - `0a878eb feat: add hybrid survival squeeze paper candidate` - `5f524d7 fix: verify paper bot process identity in dashboard` - `a7df29a feat: add relative strength paper candidate` - `eec6821 feat: add defensive strategy lab filters` - `943d04b feat: add trend and rotation strategy lab archetypes` - `git diff --stat` -> no uncommitted diff before this audit ## GitHub / remote comparison Remote refs known locally: - `origin/main`: `a5f8d92` – V61 Tight Survival Engine baseline. - `origin/chore/safety-optimizations`: `c2af0c9` – older safety branch containing the strategy readiness scorecard. Comparison: - Current local branch is **31 commits ahead of `origin/main`**. - Current local branch is **7 commits ahead of `origin/chore/safety-optimizations`**. - Network fetch using the available token returned HTTP 403 (`Write access to repository not granted`). Existing local remote refs were still sufficient to compare against known GitHub state. Conclusion: GitHub `main` is materially older than the local working tree. Do **not** reset or overwrite local files with `origin/main` / V61. ## Present in GitHub V61 baseline The GitHub `origin/main` V61 baseline contains the earlier monolithic trading bot and legacy support scripts, including: - `AutoTrader.py` - `balance.py` - `monitor.py` - `panic_close.py` - `Scanner.py` - `Trader.py` - `strategy_config.json` - older runtime/log files that are not appropriate as source-controlled live artifacts ## Local additions beyond GitHub V61 that must be preserved The local branch contains substantial paper-trading and research infrastructure absent from `origin/main`, including: - Strategy modules and registry: - `strategy.py` - `strategy_registry.py` - `strategy_presets.json` - `strategy_lab.py` - `strategy_tournament.py` - Current paper strategy candidates / families: - `candidate_v66_squeeze_breakout_sampler` - `candidate_v69_squeeze_breakout_confirmed` - `candidate_v74_relative_strength_breadth_guard` - `candidate_v75_hybrid_survival_squeeze` - Paper/runtime tooling: - `paper_trading.py` - `paper_scorecard_report.py` - `dashboard.py` - `multi_strategy_launcher.py` - `restart_state.py` - `near_miss.py` - `market_context.py` - `collect_market_context.py` - `market_data_cache.py` - `market_universe.py` - `signal_correlation.py` - `historical_replay.py` - Safety and accounting modules: - `config.py` - `risk.py` - `position_sizing.py` - `daily_metrics.py` - `journal.py` - `alerting.py` - `telegram_alerts.py` - `panic_guard.py` - Tests: - dashboard, scorecard, paper executor, position sizing, strategy expansion, strategy risk, restart state, market context, replay, Telegram paper alerting, and related regression tests. ## Files relevant for Hyperliquid execution / live-preview refactor ### Keep as source/reference, but refactor behind safe boundaries - `AutoTrader.py` - Contains CCXT Hyperliquid setup, allMids WebSocket, `metaAndAssetCtxs`, `szDecimals`, position fetching, entry/exit loop, ATR/candle calls. - Problems: monolithic, direct exchange calls in the bot loop, CCXT final executor, optional TLS verify disabling, no true live preflight, no mandatory exchange-level stop after fill. - Use only as migration reference; do not live-enable directly. - `balance.py` - Contains useful official SDK `Info.user_state` and `Info.spot_user_state` logic for USDC, margin and open positions. - Migrate into `src/hyperliquid/account_state.py` and `src/reconciliation/hyperliquid_reconciler.py`. - `monitor.py` - Contains read-only account deep-scan logic. - Migrate into `src/tools/account_health.py` / read-only monitoring. - `panic_close.py` - Contains official SDK `Exchange` / `Info` usage and already has a confirmation guard via `panic_guard.py`. - Keep, but move live-dangerous behaviour to `src/tools/panic_close.py` with explicit confirmation token, audit journal and tests. - `Scanner.py` - Contains simple Hyperliquid market data / `metaAndAssetCtxs` prototype. - Use as prototype for `src/hyperliquid/market_data.py`. - `execution.py` - Existing execution boundary for dry-run/paper-style calls. - Supersede for v76 with typed `OrderIntent` and dedicated paper/testnet/live executors. - `paper_trading.py` - Preserve and extend into realistic paper execution with fees, spread, slippage, min notional, partial/reject simulation and Hyperliquid rounding. ### Strategy / research inputs for v76 - `strategy.py` - Contains current pure entry/exit functions, including confirmed squeeze, relative strength, hybrid survival squeeze and V-shape exits. - This is the primary source for deriving `candidate_v76_hl_confirmed_squeeze_hybrid`. - `strategy_registry.py` - Contains current candidate presets and risk parameters for v66/v69/v74/v75. - Use as parameter reference, not as final live config. - `paper_scorecard_report.py` and `dashboard.py` - Extend scorecard metrics with net PnL, ex-WLD/top coin PnL, leakage windows, missing stops and open exposure mismatch. ## Legacy / should not be used as final live executor - `Trader.py` - Dry-run skeleton only. Not a final live executor. - `AutoTrader_backup_2026-03-29_17-30.py` - Historical backup only. Do not use for live. - `backtest.py`, `live_trade_analyzer.py`, `generate_cio_report.py` - Useful historical/reporting artifacts only, not live execution boundary. - Runtime/log artifacts previously seen in V61 diffs: - `trading_log.txt` - `trade_journal.jsonl` - `Tradeanalyse/*` - `portfolio_state.json` - `account_health.txt` - `profit_history.log` - `cooldowns*.json` - These belong in runtime state (`~/.local/state/CryptoTradingBot`), not source, and must not drive live execution. ## Files that must not be live-enabled directly - `AutoTrader.py` must not be switched to live directly. - Strategy code must not send orders. - CCXT-based order paths in `AutoTrader.py` must not become the final live executor. - `panic_close.py` must not run without exact wallet/confirmation-token validation and audit. - `Trader.py` must not be treated as a real executor. - Any module with disabled TLS verification (`verify=False`, `ssl.CERT_NONE`, or config-driven `tls_verify=false`) must be blocked from live-preview. ## Initial architecture decision Create a new `src/` architecture while leaving legacy files intact for reference: - Strategies produce `OrderIntent` only. - Executors are the only modules allowed to send/cancel orders. - Hyperliquid SDK is preferred for testnet/live execution. - CCXT remains legacy/reference only. - Live trading stays blocked unless both: - `CTB_LIVE_TRADING_ALLOWED=true` - valid manual `CTB_LIVE_CONFIRMATION` token is supplied. ## Immediate next implementation target Implement v76 as a safe live-preview scaffold, not as a live bot: 1. Add `OrderIntent` dataclass and execution journal. 2. Add Hyperliquid rounding and read-only market/account adapters. 3. Add pretrade, daily loss, kill-switch and coin-leakage gates. 4. Add SDK-backed executor interfaces with dry-run/testnet-safe behaviour first. 5. Add v76 strategy module derived from v69/v75/v74 logic, returning `OrderIntent` only. 6. Add tests proving no strategy Exchange calls and live execution remains blocked by default.