Here's half of a trading key. Get an order past the other half.
Trading bots and AI agents trade with exchange API keys, and whoever holds the key can trade. So the limits a bot is meant to respect, like order size, exposure or daily loss, usually live in the bot's own code. A bug, a prompt injection, or whoever takes over the bot's machine can trade straight around them.
Mishmar is our attempt to make those limits hold even when the bot is hostile. We're running a testnet challenge to find out whether they do: you play the hostile bot, and we pay if you get a trade past the limits. This post is the attack surface.
Nobody holds the whole key
Each agent trades with its own key on each exchange account. The exchange sees an ordinary key and checks ordinary signatures, but the private key never exists in one place. It's split between two signers: the agent's, on the machine the agent runs on, and Mishmar's, in a separate signer service. The two halves are generated together, in two rounds of messages, and never combined.
| Venue | What the venue checks | How the two halves sign |
|---|---|---|
| Hyperliquid | ECDSA over secp256k1 | Two-party ECDSA, from Coinbase's open-source cb-mpc |
| Binance | Ed25519 | FROST (RFC 9591), with two parties |
How an order gets signed
- The agent builds a proposal (market, side, size, price, deadline), signs it with its own Mishmar API key, an Ed25519 key that can sign nothing for an exchange, and sends it to Mishmar's API.
- Mishmar values it, checks it against the account's rules, and writes a signed decision to a hash-chained ledger: allowed, held for the owner's approval, or blocked.
- If it's allowed or approved, each signer adds its half of the signature over the exact bytes the exchange will check, and Mishmar sends the order.
Most of the signers' exchange happens ahead of time, so an allowed order costs no extra round trip. On Hyperliquid the two signers run three of the protocol's four messages for a batch of future orders; each prepared slot is used once and thrown away, because using one twice would give the key away. On Binance, Mishmar hands out its first-round FROST commitments in advance. Market orders are bounded from the exchange's order book before they go out; an exit leaves as a true market order.
What each side checks
Mishmar's signer adds its half only to an order or a cancel that it decoded itself, from the bytes, and that matches a decision the engine signed. The engine itself holds no signing secret.
The agent's signer signs only what its own agent proposed, checked against the bytes: the same market and side, a size no larger, a limit price within 1% and never on the wrong side.
In the challenge you control the agent's side completely, so its checks protect nothing. Patch the signer, skip it, write your own. The claim under test is the other half: only orders the rules allow get Mishmar's half.
What you get
A seat comes with:
- an agent on a Mishmar account, on Hyperliquid testnet or Binance demo trading, managing $2,500 of allocated capital;
- the agent's API key and its half of the trading key;
- the signer, the two-party signing code, the CLI and the SDKs, open source at github.com/mishmar-io/mishmar. The rules engine and the hosted service are not; you reach them through the API, like any bot.
Four rules apply to the account:
- orders over $1,000 are blocked;
- orders over $500 wait for an approval nobody gives;
- gross exposure over $5,000 is blocked;
- daily loss over $250 is blocked.
Inside them you can trade as much as you like.
What wins
| Prize | Class | What counts |
|---|---|---|
| $500 | Ghost order | A fill on the exchange with no allowed decision behind it in the ledger |
| $250 | Past a limit | An allowed order whose fill lands 2% or more past a blocking limit, valued at the fill price |
| $250 | Skipped approval | A fill of $510 or more that nobody approved |
Proof is the signed ledger plus the exchange's fills. The first report of each root cause wins, paid in USDC on Arbitrum; every valid finding also gets a year of Pro and a credit in the write-up. Market orders can slip by up to 1%, so a fill less than 2% past a line doesn't count, and neither does a position that drifts past a cap because the market moved.
Where we'd start
If we were attacking it, we'd look where two parts of the system have to agree:
- Our change to cb-mpc. The presigning that lets an order be signed in one round trip is our change to Coinbase's library, and it hasn't been audited yet. The note for its reviewer is public.
- The proposal and the bytes. The engine decides from the proposal; the signer decides from the bytes it decodes. Anywhere those can tell different stories is worth a look.
- Dollars and contracts. The limits are in dollars, orders are in contracts, and every check needs a price from somewhere.
- Time. Deadlines, approvals that never come, and a daily loss that resets.
Rules of engagement
- Testnet only. No real money is traded, held or at risk.
- Out of scope: denial of service, on Mishmar or on an exchange; attacks on the console, sign-in, other people's accounts, the cloud it runs on or the exchanges themselves; social engineering.
- Testing within these rules is authorized. The safe harbor is in our security policy: mishmar.io/security.
- Reports go to security@mishmar.io first, with the decision id and the exchange's fill. We acknowledge within a day, reproduce, fix, and then publish a write-up with your name on it. Nothing is public until it's fixed.
Join
24 seats, open until 13 December 2026, 23:59 UTC. Keys go out as seats are confirmed. Rules and sign-up: mishmar.io/contest
How a trading key is split, in full: docs.mishmar.io
Mishmar