Amyth
AppMarketMarketplaceRanksLeaderboardDocs
Docs Home
OverviewSet Up a WalletGet USDC on SolanaYour First Vault
OverviewStrategy PresetsThe OptimizerDeposit & Withdraw
OverviewWire Your First AlertTroubleshooting
OverviewSubscribingBecoming a CreatorPublish Quality Gates
OverviewVault ArchitectureOnchain Risk RailsVerify a Vault
OverviewThe Master ChartNotifications & SharingLeaderboard
FAQ
Glossary
DocsSecurity & TrustOnchain Risk Rails
Security

Onchain Risk Rails

Every trade signal is validated by the onchain program before it touches Jupiter. Five checks must pass. If any one fails, the instruction reverts and no trade happens.

1

Max Leverage

Every trade instruction includes the requested leverage. The program compares this against your vault's configured maximum. If the requested leverage exceeds the cap, the instruction reverts. No trade happens.

2

Max Position Size

The program checks that the proposed position size (in USD) doesn't exceed the maximum allowed. This prevents a malicious or buggy relayer from opening disproportionately large positions.

3

Slippage Cap

Each trade includes a maximum acceptable slippage. If the oracle price at execution time has moved too far from the signal price, the trade reverts. Default is 2%, enough for normal conditions, tight enough to prevent bad fills.

4

Replay Protection (Nonce)

Every trade signal includes a unique nonce (number used once). The program records each nonce and rejects any signal with a previously seen nonce. This prevents the same trade from being submitted twice, whether by accident or by attack.

5

Jupiter Program ID (Hardcoded)

The program only allows Cross-Program Invocations to the real Jupiter Perpetuals program. The Jupiter program ID is hardcoded into Amyth's onchain program. The relayer cannot redirect trade execution to a different (malicious) program. This is the most critical rail: it prevents fund redirection entirely.

What happens when a check fails

The Solana transaction reverts atomically. This means:

• No trade is executed.

• No funds are moved.

• No state changes occur.

• The failed attempt is visible onchain (the reverted transaction appears on Solscan with an error).

• Your vault continues operating normally on the next cron tick or webhook signal.

ℹ️Rails are immutable during runtime

Your vault's risk rails (leverage cap, position size, slippage) are set when you create or configure the vault. They cannot be changed while the bot is running. To update them, you must stop the bot, change the settings, and restart. This prevents any mid-trade parameter manipulation.

Was this page helpful?
← PreviousVault ArchitectureNext →Verify a Vault