docs › Copy trading (staged, personal, paper by default)

Copy trading (staged, personal, paper by default)

Follow a wallet and see its decoded swaps and PnL; turn its buys into a mirror PROPOSAL with one key; or let a capped, keypress-armed auto-mirror propose and arm them for you. Your wallet, your caps, your keys.

Copy trading in dexterm is a personal tool for your own wallet. You pick the wallets, you set the caps, your own keys sign (or the paper wallet simulates). dexterm never holds funds, never copies for anyone else, never offers pooled or hosted copying, never publishes a leader list, and takes no fee on a mirrored trade. The whole feature is labelled in progress: it is on main and tested on fixtures and the task-1286 spike recordings, but no mirror has moved real funds, and the auto tier fires through the paper executor unless the plans fire path is switched to the devnet fast wallet (see the live fire path).

It is built in three stages, each behind the previous one's gate.

Stage 1: follow a wallet, see what it does#

Press U anywhere for the FOLLOWED WALLETS screen, or use the shell:

dexterm follow add <addr> --name "my label"
dexterm follow list | stats <addr> | trades <addr> | remove <addr> | purge --yes

• Your list, your labels. A label is whatever you type, passed through the prompt firewall (an instruction-shaped label is refused, control characters are stripped, 24 characters at most). dexterm never infers who a wallet is, never scrapes X or Telegram to attribute one, and never exports the list. purge deletes every follow and label; the file is ~/.dexterm/follows.json (mode 600).
• Decoded swaps. The tracker reads the wallet's own recent history (Helius getTransactionsForAddress, 10 credits a call, newest first, through the data layer's limiter and credit meter) and classifies each transaction from the wallet's own balances: tokens up and SOL down is a buy, tokens down and SOL up a sell, tokens moved without a SOL leg a transfer (an airdrop is flagged as cost 0), tokens and SOL moving the same way is lp-like (an LP add or removal, never a swap), and two mints in one transaction is a token-swap with no SOL split, so nothing unpriceable is priced. Wrapped SOL is never a mint. The POPCAT recording from the wallet-intel spike is the regression case for the lp-like rule: its busiest launch signer receives tokens and SOL together.
• Numbers with their sample. Realised PnL is FIFO by token amount over the history fetched, in SOL exactly and in USD at today's rate (the rate is printed). Fees and tips are inside the SOL leg. Win rate is wins over closed positions and stays hidden under n = 10 (the row shows n<10 (2/4)). The early-entry score needs the token's launch-window buyer ranks (a bubble-map scan) and shows — with the reason otherwise; it has no "reached 3×" filter yet and says so. Every figure carries all N txs or last N txs only · older history not fetched.
• Alerts, not news. The first look at a wallet backfills history silently. Only transactions that appear after that raise an alert, as a toast anywhere in the app and on the screen's ALERTS tape with the lag between the block and the moment dexterm saw it. Keyless, the tracker is honestly unavailable and says how to get the free Helius key; a failed poll shows on the row and the next poll retries.

Nothing on this stage trades. A wallet's past fills say nothing about its next one, and the screen says so.

Stage 2: the one-key mirror ticket (a proposal)#

On a followed wallet, m previews a MIRROR TICKET for that wallet's latest buy. The preview shows every check and its number:

Unknown facts are shown as unknown (?), never guessed, except decimals: without them the drift cannot be computed and the mirror is refused until the token is open. The size is min(your cap, k × the leader's size, 1 % of liquidity); the cap is $20 per mirror today (the mandate's per-trade cap applies again at arming). m again proposes: an order plan, buy now, no ladder, 3 % slippage, expiring in 10 minutes, labelled copy, that lands on the O screen exactly like a typed or spoken plan. It is inert until you hold a to arm it into an armed mandate, or approve it in Phantom; nothing on the follows screen can arm.

Stage 3: capped auto-mirror (default off, less safe)#

A on a followed wallet raises the AUTO-MIRROR prompt. Turning it on is a held physical keypress, and it is refused unless the plan engine's own "this is less safe" popup (G on the O screen, keypress-only, 24 h expiry) is active. That one gesture drafts and arms a copy mandate in the plan engine, the signer trust domain: buy-only, maxTier: hands-free, with exactly the policy's caps, clamped to the engine's hard ceilings.

Every later buy by that wallet then runs the Stage 2 checks and, if they pass, is proposed and armed automatically with the weakest confirmation tier. The engine therefore sizes it at ¼ of the per-trade cap (the same rule a spoken confirmation gets) and re-checks the per-trade, per-coin, total and daily-loss caps, the allow-list and the panic state at arming and on every fill. On top, the policy keeps a per-wallet daily cap (the mandate's total), max open mirrors, a cooldown between mirrors, a size factor against the leader, and an auto-disarm streak: that many refused or failed mirrors in a row turn it off.

What turns it off, always without a gesture: A again; the ! panic key or dexterm wallet panic; restoring the keypress gate; the copy mandate expiring or being revoked; the refusal streak; unfollowing the wallet; and every restart, after which a copy mandate the engine recovered as armed is revoked on load. Caps can only be changed while it is off, from the shell:

dexterm follow auto <addr> --per-trade 20 --daily 100 --max-open 3 --cooldown 60 --k 1 --disarm 3
dexterm follow auto            # list policies and their state
dexterm follow auto <addr> --off

Ceilings: $100 per trade, $500 per day, 10 open, a 10 s minimum cooldown, k ≤ 2. Every policy change, enable, disable, proposal, arm and refusal is appended to a hash-chained journal at ~/.dexterm/copy.journal, next to the plans journal.

What is proven, what is not#

Proven on fixtures and a fake clock: the decoder on synthetic histories and the three spike recordings; the tracker's backfill-then-alert replay; every mirror refusal and the size rule; the proposal's inertness; the auto path end to end on the paper executor (enable, ¼-size arming, fill, cooldown, max-open, daily cap, the engine's own refusal of a hand-armed extra plan); the kill paths; the restart rule; and a compromised-model suite in which spoken, agent and forged gestures, a spoofed alert, a widened policy and a plan the service did not create all fail to enable, widen or auto-arm anything.

Not built or not proven: mirror-sell (you close every mirror yourself, so auto-disarm counts refusals and failed fills, not realised losses); an early-entry score with the "reached 3×" filter; a live run against real Helius history on this machine; and any mirror on devnet or mainnet.

Confirmation provenance: the engine rejects fabricated, copied, modified, cross-engine and reused proof objects. Copy automation receives a private operation scoped to its physically armed mandate; it can create new copy buys, never adopt an existing voice or agent proposal. Automation proofs stay inside the engine. The engine re-checks the less-safe opt-in, mandate lifetime, panic and existing caps. These are in-process checks: the trusted terminal captures physical input; this is not isolation against arbitrary code execution inside that trusted process.

Legal posture (flags for counsel, not advice): self-directed only, no custody, no third parties, no fees, no curated leaders, no inferred identities. See legal.