spin Custody and the guard
Who owns a Spinner's wallet, what the guard lets the bot do, and what you control.
You never give Spin your keys. Each Spinner has its own wallet, and only the wallet that holds the Spinner controls it. Spin's servers run the bot, but they can only send trades through a contract that checks each one: the guard (SpinBotGuard).
The Spinner's own wallet
Each Spinner owns a smart-contract wallet: a Tokenbound account (ERC-6551). The NFT owns the wallet, so whoever holds the Spinner controls it.
- The bot trades only from this wallet. It never touches your own wallet.
- You can deposit and withdraw ETH and tokens at any time, from the Wallet tab. See the Spinner's wallet.
- The wallet works without Spin. If Spin's servers are down, you still control the wallet on chain.
How live trading is switched on
Live trading needs four steps. The Wallet tab shows each one. See live trading.
- The Spinner is active.
- You give the bot its trading key. This lets the guard contract act for the Spinner's wallet. Spin gives this permission only to the guard contract, never to a plain key.
- You set the limits: the most ETH per trade, the most ETH per day, and how long the limits last (up to 365 days).
- The Spinner's wallet holds ETH.
Coming soon
The guard is not deployed on Robinhood Chain yet. Until it is, bots trade on paper only.
What the guard allows
For each trade, the guard:
- Accepts the trade only from Spin's servers, and only for a genuine Spinner wallet.
- Checks that the Spinner is active and that your limits are set and not expired.
- Runs the trade only through a venue adapter that it lists. Each adapter sends everything a trade produces back to the Spinner's wallet. See venues.
- Measures the ETH that leaves the wallet, with the fee and gas included, and checks it against your limits.
- Takes the 0.5% trading fee and pays the trade's gas from the wallet. The contract caps both.
What the guard refuses
- A trade through an adapter that it does not list.
- A call to the Spinner's wallet itself or to the guard.
- A buy over your per-trade limit or your per-day limit.
- Any trade after your limits expire, after you take the trading key back, or after the Spinner is sold.
While live trading is on, your per-trade and per-day limits never stop a sell. So the bot can always exit a position. After your limits expire or you revoke the key, the bot cannot sell either: you can then withdraw the tokens from the wallet yourself.
What Spin's servers can and cannot do
| Spin's servers can | Spin's servers cannot |
|---|---|
| Send trades that the guard checks, through listed adapters | Withdraw ETH or tokens to any address |
| Buy within your limits | Change your limits |
| Sell what the bot holds | Trade after you take the key back |
| Take the 0.5% fee and the trade's gas, both capped in the contract | Use your own wallet |
Spin's servers also run your strategy, your AI steps and your backtests. They follow your rules, but they cannot get past the guard.
What you control
- Limits. Change the per-trade limit, the per-day limit and how long they last, at any time.
- Pause. Pause the bot on its page. A paused bot makes no new trades. Open positions still exit by their rules.
- Paper or live. Switch the bot back to paper at any time.
- Revoke. Press "Revoke the bot's key and limits". This takes back the trading key and clears the limits. Either one alone stops live trading.
- Withdrawals. Withdraw ETH and tokens from the Spinner's wallet to your own wallet at any time.
A sale moves everything with the NFT
When a Spinner is sold or transferred, its wallet, everything in it, its strategy and its record move with it.
- The Spinner becomes inactive. The new holder pays the activation fee again.
- The trading key and the limits that the old holder set stop working. The new holder sets their own.
- Until the sale completes, the seller still controls the wallet and can move its funds.
So withdraw the wallet's funds before you list a Spinner. When you buy one, pay for the Spinner and its record, not for its balance. See transfers.
What still needs your trust
- Venue adapters. The protocol decides which adapters the guard lists, and can add new ones. Each adapter is a small contract that sends a trade's output back to the Spinner's wallet. Your ETH limits apply to every buy through any adapter.
- Bad trades within your limits. If someone took over Spin's servers, they could make bad trades within your limits. They still could not withdraw. Keep your limits as small as your strategy needs.
- Pause for everyone. The protocol can pause the guard for every bot. You can still withdraw from the wallet while it is paused.
See risks for the full list.