Wallet and trading-key security
You control the owning wallet; Owly generates and stores the API key used by automated strategies. The current Trade terminal stores its API trading authorization persistently in this device’s browser. Never send any private key or seed phrase to the Assistant or support. See Non-Custodial Security. An API Wallet cannot replace the owner’s external withdrawal signature, but can execute trades that lose funds. Verify the signer and permission scope, and revoke compromised authorizations through the owning wallet. Stopping a bot, removing a manager, and revoking an API Wallet are separate operations.Trading risks
Past results do not guarantee future performance. A ranking score, simulation, or read-only Ghost view does not guarantee a strategy is suitable or will be copied successfully.
Funding and protocol risks
- Check the route’s network and token before signing. The integrated Trade funding flow supports Arbitrum One mainnet; LeverAcc also uses HyperEVM.
- Review gas, swap, bridge/CCTP, activation, and protocol charges separately.
- Pending submissions can be uncertain. Check the existing operation before repeating it.
- Smart contracts, bridges, exchanges, wallet software, and upstream providers can fail. Code availability alone is not evidence of a security audit.
- LeverAcc collateral and borrowing introduce interest and liquidation risk. Stopping trading or closing positions does not repay debt.
Managing incidents
- Stop affected automation and inspect positions and outstanding orders.
- Revoke or replace the affected trading authorization with the owning wallet. For LeverAcc, follow its execution-wallet update flow.
- Check pending funding operations and transaction hashes before making further transfers.
- Contact Telegram support or security@owly.fi with public addresses, issue time, and redacted evidence. Do not publish secrets or vulnerabilities in public chat.