Trading on Torii

Torii is NightWatch's trading terminal for Hyperliquid, a non-custodial exchange. Non-custodial means NightWatch never holds your money: your funds sit in your own Hyperliquid account, and NightWatch asks that account to place orders through a limited key. This chapter covers the two markets you can trade, how that limited key works, how the Telegram trading flow works, and which parts of this are live today versus planned for later.

Two separate markets, not two versions of the same thing

Hyperliquid runs more than one order book (Hyperliquid calls each one a "dex") under one exchange. NightWatch uses two of them, and they are not substitutes for each other.

NightWatch checked this by reading real trade fills rather than trusting Hyperliquid's published rate card, and found xyz is roughly 4 times cheaper to trade than the main market, in practice. That's the opposite of what the published rate card implies on paper, which reads as though xyz should cost roughly 2 times more than the main market. In other words: trust the measured fills over the rate card here. A position in a crypto perp and a position in an AI-stock or commodity perp do not automatically share margin: they sit in separate collateral pools unless your own Hyperliquid account has one of Hyperliquid's pooled account modes turned on, which is a Hyperliquid account setting, not something Torii changes for you.

The trade-only agent key

When you "enable trading" in NightWatch, you are not handing NightWatch your wallet's private key. You are approving a second, separate key called an agent key (Hyperliquid's own name for this is an API wallet) that can only place and cancel orders.

This was verified directly against Hyperliquid's live network, not assumed from documentation: an agent key can sign trading orders, but any attempt to withdraw funds signed by an agent key is rejected by Hyperliquid itself, at the protocol level. Moving collateral between a user's own balances is a separate story. Hyperliquid does have a signature type that lets an agent key move funds between a user's own balances, and NightWatch has not fully tested how far that permission actually reaches - this is a question the team is still working through, not one it has ruled out. What NightWatch can say with confidence is that its own Telegram approval flow does not rely on that agent-side capability: the "send funds from your main balance to the xyz balance" step described below is designed to require your own wallet's signature, not the agent key's. So the worst case if a NightWatch-issued agent key were ever stolen is that someone places bad orders while your money stays inside your own Hyperliquid account and cannot be withdrawn; whether such a key could also shuffle funds between your own balances is a question NightWatch is still testing, not one it has ruled out.

Each agent key issued through the Telegram flow is also short-lived: it is valid for 30 days from approval, tied to one physical device, and expires automatically. A separate, longer-lived agent key exists for NightWatch's own server-run trading paths; the two are not interchangeable.

How Telegram trading gets turned on

Enabling trading from the Telegram Mini App is a multi-step handshake designed so that no single compromised system (not the Telegram app, not the phone, not NightWatch's own server) can approve a trading key by itself. It runs like this:

1. Tap "Enable trading" in the Mini App. This creates an approval request that expires after 5 minutes if unused.
2. NightWatch opens /torii/approve in your regular browser (not inside Telegram), where you sign in with the same wallet already linked to your NightWatch account.
3. Compare the match code. The page shows a 6-character code, which is simply the last 6 characters of the new agent's wallet address. The Telegram app shows the same 6 characters on your phone. You are asked to eyeball-compare the two before continuing. This exists specifically so that if NightWatch's server were ever compromised and tried to swap in a different agent address, you would catch it here, because the code shown on your phone would not match the one your browser is about to approve.
4. Approve on Hyperliquid. Your connected wallet signs Hyperliquid's own "approve agent" message. This is a real signature from your wallet, and Hyperliquid, not NightWatch, is the one that checks and accepts it.
5. Optional: fund the stock desk. You can move a percentage (25%, 50%, all, or skip) of your main-market USDC balance over to the xyz desk so you have something to trade with there. This step can be skipped entirely and crypto trading still works. As noted above, this transfer step requires your own wallet's signature, not the new agent key's.
6. Claim. The browser tells NightWatch's server the approval is done, using the same match code, which is what actually links your Telegram account to the new agent key server-side.

If your connected wallet doesn't match the wallet already on file for your account, the flow stops and shows a mismatch screen rather than letting you sign with the wrong wallet.

Spending limits (caps)

Every order placed through Torii is checked against dollar limits before it is allowed to go out. These limits can change over time, so this book describes what each one controls rather than quoting exact figures:

By default, an order that closes an existing position (a "reduce-only" order) is checked against these exact same per-order and daily caps as any other order; closing a position gets no special exemption automatically. NightWatch has also built a separate, higher ceiling meant only for closing orders, so that a cap intended to limit new risk-taking doesn't someday trap someone inside a position they're trying to exit. That higher ceiling is not in this version yet: today, closing a position costs you the same daily and per-order room as opening one.

The region check (geo gate)

NightWatch has built a region check for the Telegram trading path specifically; the web /torii page has no region check at all. When you try to enable or place a trade through Telegram, NightWatch first looks at the residency setting already stored on your account, and only falls back to a geo hint from the network layer - the country code its network provider (Cloudflare) reports for your connection - if that account setting isn't stored. That Cloudflare signal can't be spoofed by anything the visitor's own browser sends, though this protection holds only as long as traffic to NightWatch can't be routed around Cloudflare entirely. This check exists, but it is not in this version: today it does not block anyone by region. NightWatch can turn it on later if a legal review concludes it's needed.

Is trading actually live right now?

Be direct about this: live order placement works today only for one account - NightWatch's operator, trading through their own allowlisted Hyperliquid account on the web terminal. Trading for all other accounts is not in this version; it's planned for v1.1 ("trading for all accounts with your own key").

For everyone else, new orders are not accepted yet, though existing positions can still be closed so nobody gets trapped. That closing carve-out works today; the separate, higher ceiling for closing orders described above is not in this version yet.

A signed-in user who is not the operator's allowlisted account gets a clear "not authorized" response from the web terminal rather than a fake success.

So, honestly: the approval handshake described above, the agent-key security model, and the caps are all real, built and working today. What isn't available yet is pushing a live order to Hyperliquid from any account other than the operator's - that's the v1.1 milestone.

Funding your account

/torii/fund previews a two-step bridge for getting money into your Hyperliquid balance:

1. A third-party widget would bridge a token from almost any chain into native USDC sitting in your own Arbitrum wallet.
2. A NightWatch panel would then move that USDC from your Arbitrum wallet into your Hyperliquid balance (Hyperliquid's deposit bridge only accepts USDC arriving on Arbitrum, which is why the first hop exists).

Moving real funds this way is not in this version; it's planned for v1.1 ("live payments on Base and Arbitrum"). Today, /torii/fund shows a preview of this flow: the bridging widget and deposit button don't appear on the page yet, and the underlying bridge hop points at Arbitrum Sepolia, a test network for Arbitrum, not the real Arbitrum network. Treat /torii/fund as a preview today, not a channel for moving real money.

Index perps: trading an index or an ETF, not just a single stock

Alongside single-name tokenized equities (SKHX, SMSN, and the rest of the xyz market described above), the xyz market also lists perps that track an index or an ETF rather than one company - the S&P 500, the Nikkei 225, Korea's KOSPI 200, and a set of sector and country ETFs such as a semiconductor ETF or a 3x-leveraged South Korea ETF. /torii/indices is a dedicated page for this subset: it shows the live level, how much it moved over the last day and the last week, trading volume, open interest, and the maximum leverage Hyperliquid allows for that market.

NightWatch calls this page a relay, and means that literally: the two buttons on each row either open NightWatch's own Torii terminal on that exact market (the same trade-only agent key and builder fee described earlier in this chapter apply there, unchanged) or send you straight to Hyperliquid's own trading page for it. Either way, NightWatch never holds your funds and never places that order for you - the page's whole job is showing you the number and getting out of your way.

One leverage note worth reading before you tap a leveraged name: two of these ETFs (a 3x semiconductor-bull fund and a 3x South-Korea-bull fund) are themselves already 3x-leveraged products before Hyperliquid's own leverage is applied on top. Any leverage you choose on Hyperliquid stacks on the fund's own built-in 3x, not replaces it - the page says so directly on those two rows.

Every row's underlying is checked against trade.xyz's own published market specifications before it's shown as a real name; a row NightWatch could not confirm that way says "reference pending" and carries no description, rather than guessing what it tracks.

What you can do now

• Open /torii to see live Hyperliquid market data for both the crypto market and the xyz market (tokenized equities and commodities), even before enabling trading.
• Open /torii/indices to see index and ETF perps specifically - the S&P 500, Nikkei 225, KOSPI 200, and sector/country ETFs - with live level, 24h/7d change, volume, open interest, and max leverage.
• Try the Telegram "Enable trading" flow to see and understand the agent-key approval handshake, including the match-code check, without assuming it will place a live order today.
• If you are NightWatch's own operator, /torii order placement works for your allowlisted account once live trading is turned on; for anyone else, it currently will not - general access is planned for v1.1.
• Do not send real funds through /torii/fund yet - treat it as a preview until NightWatch confirms live funding has been enabled and tested with a small real deposit.
• If you have questions about a specific dollar cap or which controls are currently turned on for your account, ask the NightWatch operator directly - these are values that can change over time.