Security within CATS

Security Challenges with Automated Trading Software

We cannot list all security risks and/or how we will solve them. Instead, this section is to list some of the risks we take more seriously and some of the ways these are mitigated by our actions, the exchange and our software. Everything discussed in this section is not intended as advice and please seek independent advice.

Primary attack vectors with Automated Trading Software running against exchanges

  • Data Breaches - if your keys are leaked, your trade history, balances and other information could be exposed
  • Malevolent Order creation - a nefarious actor could submit orders via their own software or a client to mess around with your orders
  • Man-in-the-Middle attacks

Secondary attack vectors with Automated Trading Software running against exchanges

  • If your main account access was exposed, ghost portfolios could be set up and balances drained to there. The attacker could leave this running for as long as they could get away with
  • An attacker could just monitor your accounts until they felt it was high enough to warrant draining

Tertiary attack vectors with Automated Trading Software running against exchanges

  • Doxing of personal data to third parties
  • Server/Hosting access and stealing of keys

Security Mitigation for Centralised Exchanges

Personal

  • Use Password Managers
  • Use multiple Password Managers
  • Be very mindful about which devices interact with the exchange
  • Be judicious about Multi-Factor authentication and if you choose to use it, what methods you use
  • Don't share passwords
  • Decide where to keep assets
  • Consider using more than one trading exchange
  • Don't use a single trading portfolio
  • Consider whom has access to verification devices
  • Consider uninstalling software when travelling with a verification device
  • Lock workstations and verification devices
  • Use Strong Passwords
  • Create new keys to prevent longstanding passwords to remain, although consider the risks of refreshing passwords

Exchange

  • Seeks additional verification from devices when managing withdrawals and other actions
  • Enforces reauthentication
  • Provides tools for disabling keys and access
  • Provides security roles to determine access levels
  • Offers wallets with seed phrases
  • Restricts each key to a portfolio only
  • Uses industry standard security

Crypto Statto and CATS

  • Storing of keys in memory only
  • Removal of configuration for API interaction
  • Zero Knowledge Trust and encrypted forwarding of data
  • Allow user to generate their own keys for encrypting which are only held by the user
  • No storage of account info
  • Monitoring of API interactions
  • Monitoring of access to the trading instance
  • Audits conducted of traffic from the trading instance