> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/normative-design/threat-model.md). # Threat model ## Assets Agent-wallet private keys, user account identity, open positions/orders, risk policies, confirmed intents, audit evidence and service credentials. ## Trust boundaries and controls | Threat | Boundary | Primary controls | | -------------------------------------------------------- | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Prompt injection becomes a trade | AI → intent | structured proposal only; untrusted context; separate intent; deterministic risk; human confirmation | | Browser/client tampers with size or price | web → API | server schemas; server-built account/market context; recompute notional; signed authZ | | Key exfiltration | execution process | managed secret/KMS, isolated service/network, redacted logs, non-root image, restricted egress | | Replay/duplicate order | API → exchange | intent ID uniqueness, `cloid`, atomic nonce owner, short expiry, reconcile before retry | | Stale or partitioned data | feeds → risk | explicit timestamps, freshness thresholds, snapshot recovery, close-only/fail-closed state | | Cross-account action | API → signer | account-scoped service/config, per-user authZ, agent wallet per process/subaccount | | Operator/browser disappears with open Hyperliquid orders | browser → BFF → signer → venue | account-bound 30-second venue `scheduleCancel` lease, monotonic presence heartbeat, complete all-DEX order inventory persisted before refresh, fail-closed deadline/heartbeat gate, explicit reconciliation after ambiguity | | Supply-chain compromise | build/deploy | lockfiles, SCA, provenance, minimal images, pinned official SDK, secret scanning | | Malicious/incorrect policy change | config → risk | versioning, peer review, signed deployment, audit event, rollback and canary | \| Prompt or tool output requests broader MCP access | external model to MCP gateway | fixed tool registry, strict inputs, exact durable scopes, no arbitrary fetch, authorization rechecked per call | | Public account data leaks to an external model without consent | MCP connection to model provider | explicit exact venue/address grants, redacted summaries, no provider order/transaction identifiers, connection-owned audit | | Stolen agent access token is replayed remotely | agent client to hosted MCP | OAuth 2.1/PKCE hosted path, exact resource audience, short expiry, refresh rotation, TLS, revocation, abuse monitoring; static bearer restricted to reviewed local setup | | OAuth token is passed through to a venue or another service | MCP gateway to downstream | audience validation, token passthrough forbidden, server-owned downstream credentials, separate signer authentication | | MCP session identifier is mistaken for authorization | transport to tool dispatcher | sessions carry transport state only; durable identity, expiry, entitlement, consent and tool/account scopes rechecked on every call | | Model gains execution through a misleading read/proposal tool | MCP tool to execution | separately versioned tools, immutable capability annotations, no submit/cancel/retry/sign/fund/withdraw aliases, fresh AEGIS and independent approval/policy boundary | ## Mainnet prerequisites Threat-model review, external security review, authenticated/authorized account connection, durable idempotency, encrypted audit storage, service-to-service mTLS or equivalent, production secret manager, region/latency validation, legal review, paper/testnet release gates and incident drills. A mainnet-capable BYO-agent path additionally requires exact-release OAuth/MCP security evidence, independent revocation and emergency-stop drills, and proof that no model-facing tool can reach a signer outside the reviewed policy controller. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://nytshift.gitbook.io/nytshift-docs/normative-design/threat-model.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.