• Base wallet private key lives in .env — never commit .env or wallets/*.json
• Sub-wallet private keys are written to wallets/<timestamp>.json during runs
• .gitignore excludes these paths by default; verify before pushing

• Use a dedicated hot wallet with only the capital you are willing to lose
• Do not reuse keys from personal or treasury wallets
• Rotate keys if logs or wallet files may have leaked
• Restrict filesystem permissions: chmod 600 .env

The API has no authentication. It can start/stop the bot and trigger fund sweeps.

• Bind to localhost in development (npm run stack)
• Do not expose port 8787 to the public internet without a reverse proxy and auth
• Treat the dashboard as operator-only tooling

Default public RPCs are convenient but:

• See your transaction patterns
• May log or rate-limit aggressive bots

Use private RPC providers for production.

The bot interacts with third-party contracts (Uniswap, PancakeSwap, Portal). Risks include:

• Malicious or honeypot tokens
• Pool manipulation / low liquidity
• Router or factory address changes on new chains

Always verify token contract and pool on a block explorer before trading.

• Failed txs still consume gas
• Stuck funds in sub-wallets if gather is not run
• Endless mode can drain base wallet if misconfigured
• High fee pools (e.g. 1% V3) burn budget quickly

Run gather or liquidate after stopping an abnormal session.

This software automates on-chain trading to increase visible volume. Depending on jurisdiction and context, this may:

• Violate exchange or launchpad terms of service
• Constitute market manipulation where prohibited
• Create tax or reporting obligations

You are solely responsible for how you use this software. The authors provide no warranty and no guidance on legality in your jurisdiction.

If you discover a security issue in this repository, open a private disclosure via GitHub Security Advisories on the repo or contact the maintainer directly. Do not post exploit details publicly before a fix is available.

• .env not tracked by git
• wallets/ not tracked by git
• Dedicated wallet with limited funds
• Private RPC configured
• API not publicly reachable
• Token and pool verified on explorer
• minBaseBalanceEth set to prevent over-drain
• Recovery plan: gather / liquidate tested